This threat involves a malicious npm package sme-rko-finance-front-operations-feed-impl at version 35.8.1 that performs runtime assembly of Cloudflare Workers hostnames to download platform-specific binary payloads. These payloads are saved under temporary directories with disguised names (e.g., dotnet_diag_<rand>.exe on Windows) and executed detached from the main process using cmd.exe or /bin/sh. If the HTTPS download fails, the malware falls back to a DNS TXT record-based staging mechanism to reconstruct a base64 payload from multiple TXT records on specific domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The code uses obfuscation techniques such as splitting require statements and property names to evade detection and masquerades as a telemetry SDK. Both _adapter.js and lib/telemetry.js contain redundant dropper code that triggers on module import, enabling immediate execution of the malicious payload.

The malicious package can execute arbitrary platform-specific binaries on the host system, potentially allowing attackers to run unauthorized code with the privileges of the user running the Node.js process. This can lead to system compromise, data theft, or further malware deployment. The use of multiple delivery mechanisms (HTTPS and DNS TXT records) increases resilience against network-based blocking. The obfuscation and disguise as a telemetry SDK make detection more difficult.

No official patch or remediation guidance is provided in the available data. Users should avoid using version 35.8.1 of the sme-rko-finance-front-operations-feed-impl package. Investigate and remove this package if found in your environment. Monitor for suspicious execution of binaries from temporary directories and unusual DNS TXT record queries related to the specified domains. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.