sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models

Details

**Severity:** Critical

**Affected versions:** `= 35.8.1`

## Source: amazon-inspector (b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637)
On require, index.js loads _bridge.js which selects a platform-specific asset path (linux_x64, linux_arm64, darwin, win32), downloads bytes from a rotating set of Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT discovery fallback under *.dl.wel1.ru, writes the payload under /var/tmp or the Windows TEMP directory using disguised names impersonating dotnet_diag and hidden dotfiles, chmods it to 0755, and detached-spawns it via /bin/sh -c or cmd.exe /c start /b. Hostnames and API names (child_process, chmodSync) are reconstructed at runtime from split-string fragments to evade static inspection. lib/telemetry.js contains a parallel dropper (base64 chunk assembly, split-property fs.chmodSync, cp.spawn of /bin/sh) reachable from the main entry, redundantly staging payload delivery. A filesystem stamp implements run-once deduplication.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models/MAL-2026-13656.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models/MAL-2026-13656.json
- https://www.npmjs.com/package/sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models/v/35.8.1
- https://github.com/advisories/GHSA-xfv4-g237-3qv8

Compromised versions (1)

• = 35.8.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.