The sme-rko-finance-front-operations-feed-models npm package version 35.8.1 includes a malicious runtime component that, when the package is loaded, downloads a native executable payload from dynamically assembled, obfuscated network endpoints. The payload is saved to temporary directories with filenames impersonating legitimate dotnet diagnostic files, given executable permissions, and then executed via shell commands. The network destinations are constructed at runtime by joining fragmented string arrays to evade static detection. Execution is rate-limited using a timestamp file to avoid frequent triggering. The downloaded binaries are attacker-controlled and unrelated to the package's stated functionality, indicating a supply chain compromise or deliberate malicious inclusion.

This malicious behavior allows an attacker to execute arbitrary native code on the host system with the permissions of the user running the npm package. The downloaded payload is opaque and attacker-controlled, potentially enabling a wide range of malicious activities including data theft, system compromise, or persistence. The use of decoy filenames and runtime obfuscation complicates detection and analysis. There is no indication of known active exploitation in the wild at this time.

No official patch or remediation guidance is currently available for this malicious package version. Users should avoid using sme-rko-finance-front-operations-feed-models version 35.8.1 and consider removing it from their environments. Monitor for updates from the package maintainers or security advisories for any official fixes or further guidance.