Malicious code in sme-rko-finance-front-payments-feed-adapter (npm)
The npm package sme-rko-finance-front-payments-feed-adapter contains malicious code that downloads and executes unsigned platform-specific binaries from attacker-controlled Cloudflare Workers and Russian domains upon require(). The package masquerades as a finance/payments adapter but performs no legitimate functionality.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of sme-rko-finance-front-payments-feed-adapter
- Ecosystems
- Attack vectors
- Affected entities
- sme-rko-finance-front-payments-feed-adapternpm package containing malicious loader code
The npm package sme-rko-finance-front-payments-feed-adapter was published with embedded malicious code designed to execute arbitrary binaries on systems where it is imported. The package advertises itself as a finance/payments adapter but contains no legitimate functionality.
Upon require(), the package loads a staged malicious adapter that reconstructs obfuscated command-and-control hostnames from split array literals, including oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, and oob-worker.cf99-9b3.workers.dev (Cloudflare Workers), with DNS TXT fallback to Russian domains sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru.
The malicious code downloads platform-specific binaries (/pkg/package, /pkg/package.exe, or /pkg/package_mac), writes them to system temporary directories (/var/tmp/.cache_ on Unix or dotnet_diag_.exe on Windows to masquerade as system diagnostics), sets executable permissions, and spawns them detached. The same fetch/decode/execute pattern is duplicated in lib/telemetry.js using obfuscated require statements and base64 decoding to evade static analysis. A stamp file prevents repeated execution.
The package was identified via Amazon Inspector and published to GitHub Security Advisory GHSA-xprg-ffr4-2rw4.
Indicators of compromise
- Packages
- sme-rko-finance-front-payments-feed-adapter
- Domains
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf103-070.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf99-9b3.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately remove sme-rko-finance-front-payments-feed-adapter from all package.json files and lock files
- Audit npm install logs and dependency trees to identify all projects that may have installed this package
- Scan systems that installed this package for unsigned binaries in /var/tmp/.cache_* and Windows TEMP directories matching dotnet_diag_*.exe patterns
- Review process execution logs for detached child processes spawned from Node.js on affected systems
- Rotate credentials and API keys on any systems where this package was installed
- Monitor C2 domains (oob-worker.cf*.workers.dev, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) for indicators of compromise
Sources
- GitHub Advisory GHSA-xprg-ffr4-2rw4 · GitHub Advisory Database
Cite this entry
"Malicious code in sme-rko-finance-front-payments-feed-adapter (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-payments-feed-adapter-npm-ze0ban
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in userbotjs-jun
The npm package userbotjs-jun was found to contain malware, potentially providing full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - containedcritical
Malware in autoai
The npm package autoai was found to contain malware, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately, and the package should be removed.
npmCompromised package - containedcritical
Malware in arc-diag-util
The npm package arc-diag-util was found to contain malware, resulting in full system compromise of any computer with the package installed or running. All secrets and keys should be rotated immediately from a different machine, and the package should be removed.
npmCompromised package - containedcritical
Malware in async-mutex-v2
Malware was discovered in the npm package async-mutex-v2. Systems with this package installed are considered fully compromised and require immediate remediation including credential rotation and package removal.
npmCompromised package