The sme-foundation-frame-manager npm package (version 20.7.8) includes malicious behavior where its index.js file unconditionally loads a runtime.js script that downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints. The binary is fetched using a DNS-TXT chunked base64 fallback mechanism resolved through *.well1.site domains. It is saved to temporary directories under deceptive names such as .cache_<hex> and dotnet_diag_<hex>.exe, given executable permissions, and executed detached via shell commands (/bin/sh or cmd.exe). The package evades static scanners by reconstructing download hosts and DNS resolver domains at runtime from split-string arrays and dynamically requiring the child_process module. There is no hash or signature verification of the downloaded binary, increasing risk.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The use of obfuscation and lack of integrity checks increases the risk of undetected malicious activity. There are no known exploits in the wild reported yet.

Patch status is not yet confirmed — check the vendor advisory or npm registry for updates. Until a fix or official guidance is available, avoid using sme-foundation-frame-manager version 20.7.8. Remove the package from projects and replace it with trusted alternatives. Monitor for updates from the package maintainer or npm security advisories.