The sme-rko-finance-front-operations-shared npm package (version 35.8.1) includes malicious code embedded in its index.js and lib/telemetry.js modules. Upon require/import, the package reconstructs obfuscated hostnames and downloads platform-specific binaries from anonymous Cloudflare workers.dev endpoints and a suspicious Russian TLD domain. These binaries are written to temporary directories under disguised filenames, permissions are set to executable, and they are detached-spawned via shell commands. The code uses obfuscation techniques to evade detection, including splitting strings and hiding sensitive API calls. Two separate import-time remote code execution paths deliver attacker-controlled binaries, enabling arbitrary code execution on the host system.

This malicious package enables remote code execution immediately upon import, allowing attackers to run arbitrary binaries on affected systems. The binaries are fetched from attacker-controlled infrastructure, potentially leading to full system compromise, data theft, or further malware deployment. The obfuscation and dual dropper mechanisms increase the difficulty of detection and mitigation.

No official patch or remediation is currently documented. Users should immediately remove and avoid using sme-rko-finance-front-operations-shared version 35.8.1. Audit systems for presence of this package and any spawned binaries. Employ supply chain security measures such as verifying package integrity and using trusted sources. Monitor for suspicious network activity to the indicated domains. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.