The npm package sme-rko-finance-front-operations-notifications-models version 35.8.1 includes malicious code embedded in _polyfill.js and lib/telemetry.js that downloads platform-specific native binaries from multiple Cloudflare Workers subdomains using https.get and DNS TXT record fallback with base64-encoded payload assembly. The binaries are saved to temporary locations (e.g., /var/tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe), permissions are set to executable (chmod 0755), and the binaries are executed detached via shell commands. The code uses dynamic string assembly to evade static analysis. The declared purpose of the package as core infrastructure utilities or telemetry is inconsistent with this behavior, indicating a supply chain compromise or malicious intent.

The malicious package can execute arbitrary native code on the host system by downloading and running opaque binaries, potentially leading to full system compromise, data theft, persistence, or further malware deployment. The use of detached execution and obfuscation techniques complicates detection and mitigation. There is no evidence of known exploits in the wild yet, but the presence of native binary droppers poses a significant risk to users of the affected package version.

No official patch or remediation is currently documented. Users should immediately avoid using version 35.8.1 of sme-rko-finance-front-operations-notifications-models. Remove the package from all environments and replace it with a trusted alternative or a clean version if available. Monitor for any signs of compromise on systems where this package was installed. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates on remediation.