Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm)
A malicious npm package named sme-rko-finance-front-payments-currency-payment-domain was published publicly, designed to mimic an internal corporate package name (dependency-confusion attack). On installation or import, the package executes arbitrary native code via multiple obfuscated loader mechanisms, establishing command-and-control communication through DNS TXT records and Cloudflare Workers.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed or imported this package during its availability on npm; full host compromise possible.
- Ecosystems
- Attack vectors
- Affected entities
- sme-rko-finance-front-payments-currency-payment-domainMalicious npm package published unscoped and public, mimicking internal corporate scope
The package sme-rko-finance-front-payments-currency-payment-domain was published to npm as a public, unscoped package with a generic "API client wrappers" description and empty author field. The package name closely mimics an internal corporate scope, consistent with a dependency-confusion attack targeting a specific organization's private package registry.
Upon require() or import, the package executes malicious code through two primary mechanisms. The index.js file loads ./loader.js, which reconstructs command-and-control hostnames via obfuscated string concatenation (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) and includes a DNS TXT-record fallback channel under *.dl.wel1.ru. A secondary execution path in lib/telemetry.js uses concatenated identifier strings ('child'+'process', 'chmod'+'Sync') to evade static analysis.
Both mechanisms fetch platform-specific executables, write them to temporary directories (/tmp on Unix, Windows Temp on Windows) under disguised names (.cache_ or dotnet_diag_.exe), set executable permissions (chmod 0755), and spawn the processes detached via /bin/sh -c or cmd.exe with unref(). This results in full native code execution on the installer's machine under attacker control.
The advisory was published on 2026-08-08 via GitHub Security Advisory GHSA-pwjh-hjvr-rv33.
Indicators of compromise
- Packages
- sme-rko-finance-front-payments-currency-payment-domain
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf100-416.workers.dev
- dl.wel1.ru
Remediation
- Immediately uninstall sme-rko-finance-front-payments-currency-payment-domain from all systems
- Audit npm install logs and dependency trees to identify all machines that installed this package
- Assume full host compromise on any system that installed or imported this package; perform forensic analysis and rebuild affected systems
- Block outbound connections to oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, and *.dl.wel1.ru at the network perimeter
- Review private npm registry access logs for any dependency-confusion attempts targeting internal package names
- Implement strict npm package name validation and private registry configuration to prevent dependency confusion attacks
Sources
- GitHub Advisory GHSA-pwjh-hjvr-rv33 · GitHub Advisory Database
Cite this entry
"Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-payments-currency-payment-domain-npm-n22q6q
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in lumen-pages-community (npm)
lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @gfe/lx-watcher (npm)
The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.
npmDependency confusionCompromised package