Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

The npm package sme-rko-finance-front-payments-allowed-tariffs-filter contains malicious code that downloads and executes arbitrary binaries from attacker-controlled Cloudflare Workers and Russian DNS fallback hosts upon installation or import. The package masquerades as a finance UI component but performs full-host code execution with no verification or configuration controls.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any Node.js application that installs or imports sme-rko-finance-front-payments-allowed-tariffs-filter
Ecosystems
Attack vectors
Affected entities
  • sme-rko-finance-front-payments-allowed-tariffs-filternpm package containing malicious code

The npm package sme-rko-finance-front-payments-allowed-tariffs-filter was found to contain malicious code that executes on require(). The _bootstrap.js module selects a platform-specific binary path from a hardcoded map and downloads an opaque executable from one of three Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with DNS TXT-record fallback to Russian domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru).

The downloaded binary is written to temporary directories (/tmp or %TEMP%) under obfuscated filenames (.cache_, dotnet_diag_.exe), made executable (chmod 0755), and spawned detached via shell commands (/bin/sh -c or cmd.exe /c start). A secondary malicious chain exists in lib/telemetry.js, which is exported as the package main entry point, using string obfuscation to hide require("child_process") and fs["chmodSync"] calls and branding itself as an "Analytics SDK."

The package contains no version pinning, hash verification, signature checks, or configuration surface to control the download destination. The package name suggests a legitimate finance-tariff-filter UI component, but the actual behavior on installation or import is arbitrary code execution on the host system.

This incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • sme-rko-finance-front-payments-allowed-tariffs-filter
Domains
  • oob-worker.cf101-adf.workers.dev
  • oob-worker.cf102-baf.workers.dev
  • oob-worker.cf103-070.workers.dev
  • sdk.dl.wel1.ru
  • ext.dl.wel1.ru
  • pkg.dl.wel1.ru
  • net.dl.wel1.ru

Remediation

  • Immediately remove sme-rko-finance-front-payments-allowed-tariffs-filter from all package.json files and lock files
  • Audit all systems where this package was installed for signs of compromise, including process execution logs, network connections to the identified Cloudflare Workers and Russian domains, and temporary file creation
  • Review npm audit logs and CI/CD pipeline logs for any installations of this package
  • Block outbound connections to oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, and the wel1.ru domain at the network perimeter
  • Regenerate any credentials or secrets that may have been exposed on affected systems
  • Use npm audit to check for any other malicious packages in your dependency tree

Sources

  1. GitHub Advisory GHSA-mp53-hghj-9r7p · GitHub Advisory Database

Cite this entry

"Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-payments-allowed-tariffs-filter-npm-14qge4

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    Malicious code in pfp-forms-sme-loan (npm)

    The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.

    npmCompromised packageMalicious commit
  2. resolvedcritical

    Malicious code in twilio-hackerone-poc-afe6937c (npm)

    The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.

    npmCompromised packageMalicious commit
  3. resolvedcritical

    Malicious code in @velliajs/discord (npm)

    @velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.

    npmCompromised packageMalicious commit
  4. resolvedcritical

    Malicious code in akamaijs-sensorv1 (npm)

    The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.

    npmCompromised packageMalicious commit