Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)
The npm package sme-rko-finance-front-payments-allowed-tariffs-filter contains malicious code that downloads and executes arbitrary binaries from attacker-controlled Cloudflare Workers and Russian DNS fallback hosts upon installation or import. The package masquerades as a finance UI component but performs full-host code execution with no verification or configuration controls.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installs or imports sme-rko-finance-front-payments-allowed-tariffs-filter
- Ecosystems
- Attack vectors
- Affected entities
- sme-rko-finance-front-payments-allowed-tariffs-filternpm package containing malicious code
The npm package sme-rko-finance-front-payments-allowed-tariffs-filter was found to contain malicious code that executes on require(). The _bootstrap.js module selects a platform-specific binary path from a hardcoded map and downloads an opaque executable from one of three Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with DNS TXT-record fallback to Russian domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru).
The downloaded binary is written to temporary directories (/tmp or %TEMP%) under obfuscated filenames (.cache_, dotnet_diag_.exe), made executable (chmod 0755), and spawned detached via shell commands (/bin/sh -c or cmd.exe /c start). A secondary malicious chain exists in lib/telemetry.js, which is exported as the package main entry point, using string obfuscation to hide require("child_process") and fs["chmodSync"] calls and branding itself as an "Analytics SDK."
The package contains no version pinning, hash verification, signature checks, or configuration surface to control the download destination. The package name suggests a legitimate finance-tariff-filter UI component, but the actual behavior on installation or import is arbitrary code execution on the host system.
This incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- sme-rko-finance-front-payments-allowed-tariffs-filter
- Domains
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf103-070.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately remove sme-rko-finance-front-payments-allowed-tariffs-filter from all package.json files and lock files
- Audit all systems where this package was installed for signs of compromise, including process execution logs, network connections to the identified Cloudflare Workers and Russian domains, and temporary file creation
- Review npm audit logs and CI/CD pipeline logs for any installations of this package
- Block outbound connections to oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, and the wel1.ru domain at the network perimeter
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Use npm audit to check for any other malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-mp53-hghj-9r7p · GitHub Advisory Database
Cite this entry
"Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-payments-allowed-tariffs-filter-npm-14qge4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit