Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm)

The npm package sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl was found to contain malicious code that executes on require(). The package's index.js loads a _bootstrap.js file that downloads platform-specific native binaries from attacker-controlled infrastructure.

The malicious binaries are fetched from Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT covert-channel fallback to *.dl.wel1.ru. The downloaded bytes are written to /tmp/.cache_ on Unix systems or %TEMP%\dotnet_diag_.exe on Windows, then executed with elevated permissions (chmod 0755) via /bin/sh -c or cmd.exe.

The attack employs obfuscation techniques including fragmented hostname construction (e.g., ["oob","-worker.c","f99","-9b3.wor","kers.d","ev"].join("")) to evade static analysis. The malicious functionality is framed as runtime analytics/telemetry with DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK environment variables as a cover story. There is no signature verification, hash pinning, or legitimate relationship between the destinations and the package's stated purpose.

The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.