The sme-rko-finance-front-payments-feed-adapter npm package version 35.8.1 is a malicious package masquerading as a finance/payments adapter. Upon require(), it triggers a staged loader that reconstructs obfuscated hostnames to contact multiple remote servers. It downloads platform-specific binaries (Linux, Windows, macOS) to temporary locations, sets executable permissions, and executes them detached from the main process. The code uses obfuscation techniques such as splitting strings and dynamic require calls to evade static detection. The package's public API also contains similar malicious loader code, ensuring execution regardless of which module is loaded first. No legitimate payment adapter functionality is present; the package solely serves to drop and execute unsigned, unpinned remote binaries.

This malicious package can lead to arbitrary code execution on any system that installs and requires it. The downloaded binaries are unsigned and unpinned, increasing the risk of further compromise or persistence mechanisms. Execution occurs with the privileges of the user running the Node.js process, potentially allowing attackers to execute arbitrary commands, install additional malware, or exfiltrate data. The obfuscation and multiple fallback domains complicate detection and mitigation.

No official patch or remediation is currently available. Users should immediately remove the sme-rko-finance-front-payments-feed-adapter package version 35.8.1 from their projects and dependency trees. Audit systems for any signs of the downloaded binaries or spawned processes described. Avoid using this package entirely, as it contains no legitimate functionality and is purely malicious. Monitor for updates from trusted sources or advisories for any future remediation guidance.