This malicious npm package version 35.8.1 loads a helper script that selects a platform-specific endpoint to download a binary payload from obfuscated Cloudflare Workers domains. The binary is saved to hidden temporary cache locations with names designed to blend in, permissioned for execution, and spawned detached with ignored stdio. A secondary execution path in telemetry.js duplicates this behavior with base64 chunked payload assembly. When direct HTTPS fetching fails, a DNS TXT record fallback reconstructs the payload from *.dl.wel1.ru subdomains. The use of array joins and string concatenation to assemble hostnames, module names, and API calls is intended to evade static detection. The package's stated functionality as an API client wrapper does not justify fetching or executing native binaries, confirming malicious code presence.

The malicious code enables arbitrary binary download and execution on the host system, potentially allowing attackers to run unauthorized code with the permissions of the executing process. This can lead to system compromise, data theft, or further malware deployment. The obfuscation and fallback mechanisms increase the difficulty of detection and removal.

No official patch or remediation is currently available. Users should immediately remove and avoid using version 35.8.1 of the sme-rko-finance-front-payments-feed-display-list-impl package. Verify all dependencies for integrity and source authenticity before installation. Employ runtime monitoring to detect unexpected binary downloads and executions. Since this is a malicious package, replacing it with a trusted alternative or verified clean version is recommended once available. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.