Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)

The npm package sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl was found to contain malicious code that triggers on package import. The package's index.js loads a _bootstrap.js module that selects a payload path based on the operating system and architecture (linux_x64, linux_arm64, darwin, win32).\n\nThe malicious code downloads an executable over HTTPS from one of several Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are assembled at runtime using array-join obfuscation. If the primary download fails, it falls back to DNS-TXT record lookups across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru.\n\nThe downloaded executable is written to /var/tmp (Linux/macOS) or %TEMP% (Windows) under a disguised filename, given execute permissions (chmod 755), and spawned as a detached process via /bin/sh -c or cmd.exe. The package.json falsely describes the module as an "API client wrappers" for an internal payments module, masking the actual malicious behavior.\n\nThe use of hostname obfuscation via array-join and DNS-TXT fallback resolution indicates deliberate evasion of static string-based security scanners. The incident was identified and credited to the OpenSSF malicious-packages project.