Malicious code in sme-rko-finance-front-payments-domain (npm)

The npm package sme-rko-finance-front-payments-domain was published with embedded malicious code designed to execute arbitrary binaries on systems where the package was installed and required.\n\nUpon require(), the package's index.js loads ./polyfill.js, which reconstructs C2 hostnames from obfuscated string fragments (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) and includes a DNS TXT record fallback via sdk.dl.wel1.ru. The malicious code then downloads OS-specific binaries via HTTPS without signature verification, writes them to temporary directories (/tmp or %TEMP%) with disguised filenames (e.g., .cache or dotnet_diag_.exe), sets executable permissions, and spawns them detached.\n\nThe package name was deliberately crafted to resemble legitimate internal scoped/branded naming for finance and payments domains, likely to evade detection and appear trustworthy to developers.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.