Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm)
The npm package sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl version 35.8.1 contains malicious code that downloads and executes an unsigned native binary from dynamically constructed Cloudflare Workers subdomains and a DNS-TXT covert-channel fallback. The binary is saved to temporary directories with names mimicking legitimate Microsoft.NET diagnostic tools and executed detached from the main process. The code attempts to disguise its behavior as telemetry with opt-out flags, but this is inconsistent with its actual malicious activity. No signature or integrity verification is performed on the downloaded binary, and the destination hosts are unrelated to the package's stated purpose.
AI Analysis
Technical Summary
This threat involves a malicious npm package (sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl, version 35.8.1) that, upon require(), loads a bootstrap script which downloads a platform-specific native binary from obfuscated Cloudflare Workers subdomains assembled at runtime. It uses a DNS-TXT covert-channel fallback to a Russian domain if needed. The binary is written to temporary filesystem locations with filenames designed to mimic legitimate Microsoft.NET diagnostic tools, given executable permissions, and executed detached from the main process. The code attempts to evade static analysis by constructing hostnames from fragmented strings and frames its behavior as analytics telemetry with opt-out environment variables, which is a deceptive cover story. There is no cryptographic verification of the downloaded binary, increasing risk. The destinations bear no relation to the package's intended functionality, indicating malicious intent.
Potential Impact
The malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence. The use of obfuscated domain construction and covert DNS-TXT fallback channels complicates detection and blocking. Execution of unsigned binaries from untrusted sources poses a high security risk. The disguise as telemetry is misleading and may cause users or automated systems to overlook the threat.
Mitigation Recommendations
No official patch or remediation is currently documented for this package version. Users should avoid using sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl version 35.8.1. Remove the package from any environments where it is installed. Monitor for any unexpected execution of binaries from temporary directories mimicking diagnostic tools. Employ network controls to block access to the identified Cloudflare Workers subdomains and the fallback domain *.dl.wel1.ru. Verify package integrity and provenance before installation. Check vendor advisories or trusted sources for updates or fixes.
Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm)
Description
The npm package sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl version 35.8.1 contains malicious code that downloads and executes an unsigned native binary from dynamically constructed Cloudflare Workers subdomains and a DNS-TXT covert-channel fallback. The binary is saved to temporary directories with names mimicking legitimate Microsoft.NET diagnostic tools and executed detached from the main process. The code attempts to disguise its behavior as telemetry with opt-out flags, but this is inconsistent with its actual malicious activity. No signature or integrity verification is performed on the downloaded binary, and the destination hosts are unrelated to the package's stated purpose.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat involves a malicious npm package (sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl, version 35.8.1) that, upon require(), loads a bootstrap script which downloads a platform-specific native binary from obfuscated Cloudflare Workers subdomains assembled at runtime. It uses a DNS-TXT covert-channel fallback to a Russian domain if needed. The binary is written to temporary filesystem locations with filenames designed to mimic legitimate Microsoft.NET diagnostic tools, given executable permissions, and executed detached from the main process. The code attempts to evade static analysis by constructing hostnames from fragmented strings and frames its behavior as analytics telemetry with opt-out environment variables, which is a deceptive cover story. There is no cryptographic verification of the downloaded binary, increasing risk. The destinations bear no relation to the package's intended functionality, indicating malicious intent.
Potential Impact
The malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence. The use of obfuscated domain construction and covert DNS-TXT fallback channels complicates detection and blocking. Execution of unsigned binaries from untrusted sources poses a high security risk. The disguise as telemetry is misleading and may cause users or automated systems to overlook the threat.
Mitigation Recommendations
No official patch or remediation is currently documented for this package version. Users should avoid using sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl version 35.8.1. Remove the package from any environments where it is installed. Monitor for any unexpected execution of binaries from temporary directories mimicking diagnostic tools. Employ network controls to block access to the identified Cloudflare Workers subdomains and the fallback domain *.dl.wel1.ru. Verify package integrity and provenance before installation. Check vendor advisories or trusted sources for updates or fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13657
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a77428dbf8831d539b06fd5
Added to database: 08/08/2026, 14:51:57 UTC
Last enriched: 08/08/2026, 15:03:51 UTC
Last updated: 08/08/2026, 16:48:24 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.