The sme-rko-finance-front-operations-other npm package version 35.8.1 includes malicious functionality where, upon require() or import, it selects an OS/architecture-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames with DNS-TXT fallback domains. The binaries are saved to temporary directories with disguised names and executable permissions, then executed detached from the main process. A secondary dropper in telemetry.js base64-decodes downloaded bytes, sets executable permissions dynamically, and spawns the file detached. Hostnames and dangerous API names are constructed at runtime from split string fragments to evade static detection. There is no integrity verification of the downloaded content, which is unrelated to the package's intended purpose.

This malicious package can execute arbitrary code on the host system by downloading and running binaries without user consent or verification. This can lead to system compromise, unauthorized access, or further malware deployment. The obfuscation and lack of integrity checks increase the risk of undetected exploitation.

No official patch or remediation is currently documented. Users should avoid using version 35.8.1 of sme-rko-finance-front-operations-other. Remove the package from affected environments and replace it with a trusted alternative. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.