This malicious npm package version 35.8.1 loads a secondary script (_support.js) on require(), which downloads a platform-specific executable payload from several obfuscated cloudflare workers.dev subdomains and a fallback domain (dl.wel1.ru). The payload is saved to temporary directories with hidden or disguised filenames and executed with elevated permissions. The main module (lib/telemetry.js) contains a duplicate dropper path that base64-decodes chunks of the payload before execution. The package constructs command and API names at runtime to evade static detection. Both dropper paths trigger immediately upon loading the package, enabling remote code execution under the guise of an analytics SDK.

The malicious package allows execution of arbitrary code on the host system immediately upon requiring the package. This can lead to full system compromise, unauthorized access, and persistent backdoor installation. The obfuscation and runtime construction of commands hinder detection and analysis, increasing the risk of unnoticed exploitation. No known exploits in the wild are reported yet, but the capability for remote code execution is severe.

No official patch or remediation is currently available for this malicious package. Users should immediately remove version 35.8.1 of 'sme-rko-finance-front-operations-special-payments' from their projects and avoid using this package. Employ strict supply chain security practices such as verifying package integrity, using trusted sources, and monitoring dependencies for malicious behavior. Consider scanning existing environments for presence of this package and any spawned payloads. Patch status is not yet confirmed — check vendor or repository advisories for updates.