Malicious code in sme-rko-finance-front-payments-feed-display-list-impl (npm)

The npm package sme-rko-finance-front-payments-feed-display-list-impl was found to contain malicious code that executes on module load. When required, the package's index.js loads helpers.js, which downloads a binary from one of three obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to a hidden system path (/tmp/.cache on Unix or %TEMP%\dotnet_diag_.exe on Windows), and executes it with detached child processes and suppressed stdio.

A secondary malicious path exists in lib/telemetry.js, which duplicates the fetch-and-execute logic using base64-chunked payload assembly. The malware includes a DNS TXT record fallback mechanism that resolves *.dl.wel1.ru subdomains to reconstruct the payload or endpoint when direct HTTPS is unavailable.

The malicious code employs multiple obfuscation techniques to evade static analysis, including array.join and string concatenation for assembling module names (child_process), API calls (chmodSync), and hostnames. Cache filenames are chosen to blend in with legitimate system artifacts (.analytics_state, dotnet_diag_*.exe).

The package's stated purpose is as an API client wrapper, which has no legitimate need to fetch or execute native binaries. The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.