This malicious npm package includes code in _platform.js and lib/telemetry.js that, upon requiring the package, selects a platform-specific asset and downloads an opaque binary payload from one of three anonymous Cloudflare Workers hosts. If HTTPS mirrors fail, it reconstructs the payload from base64 chunks retrieved via DNS TXT queries to specific domains. The payload is saved to a temporary file with randomized naming, permissions are set to executable (0755), and it is spawned detached using shell commands to survive the parent process. Hostnames and sensitive Node.js API names are dynamically constructed at runtime to evade static detection. Environment variables and file modification time caches are used as anti-analysis measures. The package falsely advertises itself as API-client wrappers, which do not require downloading or executing native binaries. The dropper logic is duplicated to ensure payload execution even if one code path is removed.

The malicious package can execute arbitrary native code on the host system by downloading and running a binary payload. This can lead to unauthorized code execution, persistence on the system, and potential compromise of the host environment. The use of obfuscation and fallback mechanisms increases the difficulty of detection and removal.

No official patch or remediation is currently documented. Users should immediately stop using version 35.8.1 of sme-rko-finance-front-operations-widget-models. Remove the package from all environments and replace it with a trusted alternative. Monitor for any unauthorized processes spawned by this package and investigate any suspicious activity related to the described domains and Cloudflare Workers hosts. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates on remediation.