sme-rko-finance-front-operations-penalty

Details

**Severity:** Critical

**Affected versions:** `= 35.8.1`

## Source: amazon-inspector (6b92a10d396bb1914ec6de4aff1dbd6845b09bcc1087fa8b1c49cf455d33d887)
On require() of the package, _runtime.js and lib/telemetry.js reassemble Cloudflare Workers hostnames (oob-worker.cf103-07/cf99-9b3/cf100-416/cf101-adf.workers.dev) from split string arrays, fetch a platform-specific binary from /pkg/package[-arm64|.exe|loader_mac], write it to /var/tmp/.cache_<uid> on Unix or %TEMP%\dotnet_diag_<uid>.exe on Windows, chmod 0755, and spawn it detached via /bin/sh -c or cmd.exe. A DNS TXT chunked-base64 fallback channel to *.dl.wel1.ru is used when HTTPS fails. Obfuscation techniques include string-split concatenation of host names, dynamic require("child_" + "process"), bracket-notation fs["chmod" + "Sync"], and disguised filenames masquerading as system diagnostics (dotnet_diag,.analytics_state,.cache_*). Both the auxiliary _runtime.js and the main entrypoint lib/telemetry.js reachable via index.js contain the dropper primitives, ensuring execution on import.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-operations-penalty/MAL-2026-13645.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-operations-penalty/MAL-2026-13645.json
- https://www.npmjs.com/package/sme-rko-finance-front-operations-penalty/v/35.8.1
- https://github.com/advisories/GHSA-h56m-2x6r-3fx2

Compromised versions (1)

• = 35.8.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.