sme-rko-finance-front-operations-providers

Details

**Severity:** Critical

**Affected versions:** `= 35.8.1`

## Source: amazon-inspector (85709f3e95d677177f1e55976d46cf4e16582e9cf3c1b310a7e67dd09885a743)
On require() of the package, index.js loads _bridge.js which assembles Cloudflare Workers subdomain hostnames from split string fragments (oob-worker.cf103-070.workers.dev, cf100-416, cf101-adf.workers.dev) and downloads a platform-specific binary via https.get. The fetched bytes are written to a decoy path under /tmp or %TEMP% (.cache_<hex>/dotnet_diag_<hex>.exe), chmod 0755 on Unix, and executed detached via spawn("/bin/sh",["-c", fp+" &"]) or spawn("cmd",...) on Windows. A DNS-TXT fallback channel resolves shards from wel1.ru (sdk.dl.wel1.ru assembled from fragments) — a count record c.<domain> followed by numeric shards <i>.<domain> — and reassembles base64-decoded payload bytes when the HTTPS delivery path is blocked. Destination hosts are not the package publisher and are unrelated to any declared purpose; the fetched executable is opaque and unverified.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-operations-providers/MAL-2026-13646.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-operations-providers/MAL-2026-13646.json
- https://www.npmjs.com/package/sme-rko-finance-front-operations-providers/v/35.8.1
- https://github.com/advisories/GHSA-cg6q-c6gh-62q2

Compromised versions (1)

• = 35.8.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.