This malicious npm package (sme-rko-finance-front-payments-domain v35.8.1) executes code that dynamically constructs C2 hostnames by joining string fragments, including fallback DNS TXT record retrieval. It downloads an OS-specific binary via HTTPS from these C2 hosts, saves it under temporary system directories with obfuscated filenames, modifies permissions to make it executable, and spawns it in a detached shell process. The lack of pinning or signature verification allows arbitrary code execution from untrusted sources. The package name mimics an internal finance/payments domain to evade suspicion.

The package enables remote code execution by downloading and running arbitrary binaries from attacker-controlled servers without verification. This can lead to full system compromise, persistence, and further malicious activity. The disguised package name increases the likelihood of supply chain compromise in environments relying on npm packages for finance-related applications.

No official patch or remediation is currently documented. Users should immediately remove and avoid using sme-rko-finance-front-payments-domain version 35.8.1. Audit dependency trees for this package and replace it with trusted alternatives. Monitor for any binaries or processes spawned from temporary directories with suspicious names. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.