This threat involves a malicious npm package named sme-rko-finance-front-operations-holding-domain at version 35.8.1. When required, its _shim.js script executes a bootstrap function that fetches platform-specific native binaries from obfuscated hosts (oob-worker.cf10{0,1,2}-*.workers.dev and *.dl.wel1.ru). The binaries are saved to temporary directories with randomized names, permissions are set to executable, and they are spawned detached from the main process using shell commands. The main library telemetry.js duplicates this download, decode, chmod, and execute chain, hiding the behavior under a telemetry SDK pretense. Hostnames and dangerous function calls are constructed dynamically to evade static detection. Additional anti-analysis features include endpoint shuffling, cache/cooldown files, and environment variable checks to opt out, indicating deliberate evasion rather than legitimate telemetry.

The malicious package can execute arbitrary native code on the host system with the privileges of the running process. This can lead to unauthorized code execution, persistence, and potentially further compromise of the affected environment. The obfuscation and anti-analysis techniques increase the difficulty of detection and analysis, raising the risk of stealthy malicious activity.

No official patch or remediation is currently documented. Users should avoid using version 35.8.1 of the sme-rko-finance-front-operations-holding-domain package. Investigate and remove the package if already installed. Monitor for suspicious processes spawned from npm modules and restrict execution permissions in temporary directories. Check vendor advisories or trusted security sources for updates or official fixes.