This threat involves a malicious npm package version 35.8.1 that unconditionally loads a runtime JavaScript file (_runtime.js) which detects the host OS and architecture and downloads a platform-matched binary over HTTPS from hardcoded Cloudflare workers.dev subdomains. If the HTTPS retrieval fails, it falls back to a covert DNS-TXT channel under *.dl.wel1.ru to retrieve base64-encoded payload chunks, which are reassembled into a binary. The binary is saved to temporary directories with disguised filenames mimicking legitimate .NET diagnostic tools, permissions are set to executable, and it is launched detached via shell commands. The delivery infrastructure is anonymous and unrelated to any legitimate publisher of the finance/payment-registers package, indicating a supply chain compromise or malicious package insertion.

The malicious package can execute arbitrary platform-specific binaries on the host system without verification, potentially leading to full system compromise or unauthorized actions. The use of covert DNS channels and anonymous infrastructure complicates detection and attribution. This poses a significant risk to users who install or depend on this specific npm package version.

No official patch or remediation is currently documented. Users should avoid using version 35.8.1 of the sme-rko-finance-front-payment-registers-operations-domain package. Investigate alternative trusted package versions or sources. Monitor for updates from the package maintainers or security advisories for official fixes. Due to the nature of the threat, removing the affected package and scanning affected systems for the presence of the malicious binary is recommended.