The 'sme-rko-finance-front-payments-feed-display-list' npm package (version 35.8.1) includes a module (_compat.js) that unconditionally downloads a platform-specific executable from dynamically assembled anonymous *.workers.dev subdomains. The downloaded binary is saved under decoy filenames in temporary directories, permissioned for execution, and launched detached via child_process.spawn using platform-appropriate shells. If the HTTP download fails, the package attempts to retrieve the payload by resolving DNS TXT records from *.dl.wel1.ru domains, reconstructing a base64-encoded binary in chunks, which it then executes. No integrity checks such as hash or signature verification are performed on the downloaded payload. This behavior is indicative of a malicious package masquerading as a finance frontend UI component.

This package enables remote code execution on the host system by downloading and running arbitrary binaries without verification. The malicious payload can execute with the privileges of the running process, potentially leading to full system compromise, data theft, or further malware deployment. The use of dynamic URL assembly and fallback DNS-based payload retrieval complicates detection and analysis.

No official patch or remediation is currently available for this package version. Users should immediately remove and avoid using 'sme-rko-finance-front-payments-feed-display-list' version 35.8.1. Audit dependencies for this package and replace it with trusted alternatives. Monitor for any signs of compromise if this package was previously installed. Since no vendor advisory or patch information is provided, patch status is not yet confirmed — check relevant vendor or repository advisories for updates.