Malicious code in sme-rko-finance-front-operations-income (npm)
The npm package sme-rko-finance-front-operations-income version 35.8.1 contains malicious code that, upon import, reconstructs attacker-controlled hostnames to download and execute a platform-specific native binary. This binary is saved to temporary directories with disguised filenames and executed detached from the parent process. A covert fallback channel uses DNS TXT records to deliver the executable, bypassing HTTPS-based network filtering. The package falsely advertises monitoring functionality but solely acts as a remote code execution dropper.
AI Analysis
Technical Summary
The sme-rko-finance-front-operations-income npm package version 35.8.1 includes obfuscated code that reconstructs attacker-controlled hostnames and downloads a native executable over HTTPS. The executable is saved under hidden or disguised filenames in temporary directories and executed detached via shell commands. If HTTPS delivery fails, a fallback mechanism retrieves the executable via DNS TXT record queries, base64-decodes the chunks, and reassembles the binary for execution. This covert delivery channel evades HTTPS-based network filtering. The package does not provide any legitimate monitoring or observability functionality and is designed as a supply-chain remote code execution dropper.
Potential Impact
This malicious package enables remote code execution on any system that imports it, allowing attackers to run arbitrary native code with the privileges of the importing process. The use of obfuscation, disguised filenames, detached execution, and a DNS-based covert channel complicates detection and mitigation. This poses a significant risk of system compromise, data theft, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately stop using sme-rko-finance-front-operations-income version 35.8.1 and remove it from their projects. Verify dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected processes or files in temporary directories that match the described behavior. Check vendor advisories or trusted security sources for updates or official fixes.
Malicious code in sme-rko-finance-front-operations-income (npm)
Description
The npm package sme-rko-finance-front-operations-income version 35.8.1 contains malicious code that, upon import, reconstructs attacker-controlled hostnames to download and execute a platform-specific native binary. This binary is saved to temporary directories with disguised filenames and executed detached from the parent process. A covert fallback channel uses DNS TXT records to deliver the executable, bypassing HTTPS-based network filtering. The package falsely advertises monitoring functionality but solely acts as a remote code execution dropper.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The sme-rko-finance-front-operations-income npm package version 35.8.1 includes obfuscated code that reconstructs attacker-controlled hostnames and downloads a native executable over HTTPS. The executable is saved under hidden or disguised filenames in temporary directories and executed detached via shell commands. If HTTPS delivery fails, a fallback mechanism retrieves the executable via DNS TXT record queries, base64-decodes the chunks, and reassembles the binary for execution. This covert delivery channel evades HTTPS-based network filtering. The package does not provide any legitimate monitoring or observability functionality and is designed as a supply-chain remote code execution dropper.
Potential Impact
This malicious package enables remote code execution on any system that imports it, allowing attackers to run arbitrary native code with the privileges of the importing process. The use of obfuscation, disguised filenames, detached execution, and a DNS-based covert channel complicates detection and mitigation. This poses a significant risk of system compromise, data theft, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately stop using sme-rko-finance-front-operations-income version 35.8.1 and remove it from their projects. Verify dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected processes or files in temporary directories that match the described behavior. Check vendor advisories or trusted security sources for updates or official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13639
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a77428ebf8831d539b07039
Added to database: 08/08/2026, 14:51:58 UTC
Last enriched: 08/08/2026, 15:05:25 UTC
Last updated: 08/08/2026, 15:05:25 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.