The npm package sme-rko-finance-front-operations-overnight (version 35.8.1) contains embedded malicious code that, upon require, loads scripts (_ext.js and lib/telemetry.js) which fetch a platform-specific opaque binary from a rotating list of attacker-controlled Cloudflare Workers domains. The code uses runtime string assembly to evade static analysis and downloads the binary with a DNS-TXT chunked-base64 fallback. The binary is saved to temporary directories with disguised filenames, permissions are set to executable, and it is spawned detached from the main process using shell commands. Execution is limited by timestamp files and environment variable checks to avoid repeated runs and sandbox detection. The malicious dropper code is duplicated in multiple entry points to ensure persistence. There is no hash pinning, signature verification, or version pinning, allowing attackers to deliver arbitrary payloads.

This malicious package enables remote code execution of attacker-controlled binaries on the host system where the package is installed. The attacker can execute arbitrary code with the permissions of the running process, potentially leading to system compromise, data theft, or further malicious activity. The obfuscation and execution gating mechanisms reduce detection likelihood and complicate incident response.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.8.1) of the sme-rko-finance-front-operations-overnight package from their environments. Avoid using this package until a trusted, verified version is released. Monitor for suspicious processes spawned from npm packages and restrict execution permissions in temporary directories. Verify package integrity before installation and prefer packages with signature verification and version pinning.