sme-rko-finance-front-operations-tax

Details

**Severity:** Critical

**Affected versions:** `= 35.8.1`

## Source: amazon-inspector (ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa)
On require, index.js loads _platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf) with a DNS TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or Windows Temp under disguised names (e.g.,.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive API names (child_process, chmodSync) are reassembled at runtime from split string arrays to defeat static analysis. The package's stated purpose (finance/tax operations frontend) has no legitimate need to fetch and execute an opaque native binary from non-publisher infrastructure.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-operations-tax/MAL-2026-13649.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-operations-tax/MAL-2026-13649.json
- https://www.npmjs.com/package/sme-rko-finance-front-operations-tax/v/35.8.1
- https://github.com/advisories/GHSA-p2hc-6684-r35c

Compromised versions (1)

• = 35.8.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.