sme-rko-finance-front-operations-domain

Details

**Severity:** Critical

**Affected versions:** `= 35.8.1`

## Source: amazon-inspector (e254c7a7e7f82c38dddb46c9c694cef8f91ac1731565c61e7d17b30d291bd7ac)
On require of the package, index.js loads _shim.js which self-executes an async initializer that assembles platform-specific hostnames from split-string arrays (e.g. ["oob-worker.cf102-b","af.w","or","kers.","de","v"].join("") and ["pkg.dl.wel1.r","u"].join("")) targeting oob-worker.cf102-baf.workers.dev and sdk/ext/pkg/net.dl.wel1.ru, downloads a native binary over HTTPS, writes it to /tmp or %TEMP% under disguised names (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. A DNS-TXT fallback channel (dns.resolveTxt on c.<domain>, 0.<domain>, 1.<domain>,...) reassembles and base64-decodes a payload when HTTPS retrieval fails, bypassing HTTP egress controls. lib/telemetry.js, loaded from index.js and presented as an observability/Sentry-like SDK, contains the same base64-materialize + chmodSync + child_process.spawn("/bin/sh",...) dropper primitives, providing a duplicate execution path. child_process, chmodSync, and endpoint hostnames are reconstructed at runtime from concatenated fragments to evade static scanners. No integrity check or pinned publisher-owned source; the fetched bytes are opaque and unverifiable.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-operations-domain/MAL-2026-13634.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-operations-domain/MAL-2026-13634.json
- https://www.npmjs.com/package/sme-rko-finance-front-operations-domain/v/35.8.1
- https://github.com/advisories/GHSA-4rj4-828w-hv35

Compromised versions (1)

• = 35.8.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.