Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm)
The npm package sme-rko-finance-front-payment-registers-operations-domain contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package uses obfuscated string construction to hide command-and-control domains and implements a DNS-TXT fallback channel for payload delivery.
- Disclosed
- Last updated
- Blast radius
- Any developer or application that installed the malicious package version(s) from npm.
- Ecosystems
- Attack vectors
- Affected entities
- sme-rko-finance-front-payment-registers-operations-domainnpm package containing malicious code
The npm package sme-rko-finance-front-payment-registers-operations-domain was found to contain malicious code in its index.js file. Upon require, the package unconditionally loads a _runtime.js module that performs reconnaissance of the host operating system and architecture.
The _runtime.js module then attempts to download an opaque platform-matched binary from hardcoded Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) over HTTPS. If the HTTPS retrieval fails, the code falls back to a covert DNS-TXT channel using domains under *.dl.wel1.ru, requesting chunk-count records and reassembling base64-encoded payload chunks.
The downloaded binary is written to temporary directories (/var/tmp or %TEMP%) under disguised filenames (.cache_ or dotnet_diag_.exe) to mimic legitimate system tools, given execute permissions (0755), and spawned as a detached process via shell commands (/bin/sh -c or cmd.exe /c start /b). The malicious infrastructure domains and DNS channels are constructed using obfuscated string operations to evade detection.
The package was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-vrgq-5852-3299.
Indicators of compromise
- Packages
- sme-rko-finance-front-payment-registers-operations-domain
- Domains
- oob-worker.cf103-070.workers.dev
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- dl.wel1.ru
Remediation
- Immediately remove the sme-rko-finance-front-payment-registers-operations-domain package from all projects and dependencies
- Audit npm package.json and lock files for any installations of this package
- Review and revoke any credentials or secrets that may have been exposed on systems where the package was installed
- Monitor systems that installed this package for signs of compromise, including unexpected network connections to Cloudflare Workers subdomains or *.dl.wel1.ru domains
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious packages before installation
- Consider using npm audit and third-party supply chain security tools to identify similar threats
Sources
- GitHub Advisory GHSA-vrgq-5852-3299 · GitHub Advisory Database
Cite this entry
"Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-payment-registers-operations-domain-npm-trsy6k
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit