sme-rko-finance-front-operations-shared

Details

**Severity:** Critical

**Affected versions:** `= 35.8.1`

## Source: amazon-inspector (a26817ccf57c03ae447f3181ec0a18c3cf5a2bcd09da40cd8aaa3fa56446ab21)
On require/import, index.js loads./_bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. _bootstrap.js reconstructs hardcoded hosts via array-join obfuscation (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, with a DNS-TXT chunked fallback under *.dl.wel1.ru), fetches a platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under a disguised name (.cache_<rnd> / dotnet_diag_<rnd>.exe), chmods 0o755 on POSIX, and detached-spawns it via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}).unref(). Sensitive APIs are also obfuscated (require('child_'+'process'), fs['chmod'+'Sync']) to evade string-based scanners, and markerFresh() rate-limits re-execution. lib/telemetry.js (the module actually exported from index.js) contains a parallel dropper that base64-decodes embedded chunks, writes them to disk, chmods 0o755 via the same obfuscated accessor, and detached-spawns them through /bin/sh. The package presents as "analytics" but ships two independent import-time RCE paths delivering attacker-controlled binaries from anonymous Cloudflare workers.dev endpoints and a Russian lookalike TLD, unpinned and unverified.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-operations-shared/MAL-2026-13647.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-operations-shared/MAL-2026-13647.json
- https://www.npmjs.com/package/sme-rko-finance-front-operations-shared/v/35.8.1
- https://github.com/advisories/GHSA-pp5j-rx3f-4m7x

Compromised versions (1)

• = 35.8.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.