This malicious npm package, sme-rko-finance-front-payments-allowed-tariffs-filter version 35.8.1, executes arbitrary code on the host by downloading opaque binaries from obfuscated Cloudflare Workers hosts and fallback DNS TXT-record domains. The binaries are saved to temporary directories with misleading filenames, permissions are set to executable, and they are spawned detached using shell commands. The package's telemetry module further obfuscates its API access by dynamically constructing require and filesystem calls. There is no integrity verification or configuration to control the download destination, resulting in untrusted full host code execution upon package import.

Successful use of this package results in arbitrary code execution on the host system, potentially allowing attackers to run any code with the privileges of the importing process. This compromises system integrity and confidentiality, enabling further malicious activities such as data exfiltration, persistence, or lateral movement.

No official patch or remediation is currently documented. Users should immediately remove and avoid using version 35.8.1 of sme-rko-finance-front-payments-allowed-tariffs-filter. Verify dependencies for malicious packages and replace with trusted alternatives. Monitor for suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.