Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)
The npm package sme-rko-finance-front-payments-feed-display-list contained malicious code that downloads and executes platform-specific binaries on require, using obfuscated domain resolution and DNS TXT record fallback channels. The package was disguised as a benign finance-frontend UI component but performed arbitrary code execution without verification.
- Disclosed
- Last updated
- Blast radius
- Any system that installed and required the malicious package; potential for arbitrary code execution across Linux, macOS, and Windows platforms.
- Ecosystems
- Attack vectors
- Affected entities
- sme-rko-finance-front-payments-feed-display-listnpm package containing malicious code in _compat.js
The npm package sme-rko-finance-front-payments-feed-display-list was found to contain malicious code in its _compat.js module. Upon requiring the package's main module, the code unconditionally downloads a platform-specific executable and executes it.
The malicious behavior uses obfuscation techniques to evade static analysis, including split string arrays that are joined at runtime to construct domain names (e.g., ['oob-','worker.cf99-9b3.wo','rkers.de','v'].join('')), resolving to anonymous *.workers.dev subdomains that do not match any legitimate package publisher. Downloaded binaries are written to temporary paths under decoy names such as dotnet_diag_*.exe or .cache_*, made executable (chmod 0755), and spawned detached via child_process.spawn() using /bin/sh on Unix-like systems or cmd on Windows.
When HTTP fetch fails, a fallback mechanism resolves DNS TXT records at subdomains under *.dl.wel1.ru to retrieve a chunk count, then reassembles base64-encoded payload chunks and executes the resulting binary. No hash or signature verification is performed on any downloaded content.
The package name presents as a benign finance-frontend UI component, which is inconsistent with its actual download-and-execute behavior, indicating intentional deception.
Indicators of compromise
- Packages
- sme-rko-finance-front-payments-feed-display-list
- Domains
- *.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately remove the package sme-rko-finance-front-payments-feed-display-list from all environments
- Audit all systems where this package was installed for signs of compromise or unauthorized binary execution
- Review process logs and network connections for suspicious activity related to *.workers.dev or *.dl.wel1.ru domains
- Regenerate credentials and secrets on any affected systems
- Update npm dependencies and use npm audit to identify any remaining malicious packages
- Implement package verification and integrity checks in your supply chain
Sources
- GitHub Advisory GHSA-6cqr-56m6-wch6 · GitHub Advisory Database
Cite this entry
"Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-payments-feed-display-list-npm-19xrje
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in knip-bun
The npm package knip-bun was found to contain malware, resulting in full system compromise for any computer with the package installed or running. All secrets and keys should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in requestor-util
Malware discovered in the npm package requestor-util. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in claudechor
Malware was discovered in the npm package claudechor. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package