Threats tagged 'mal-2026-13655'

The npm package 'sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl' version 35.8.1 contains malicious code that executes remote code upon loading. It downloads an executable payload from obfuscated Cloudflare Workers subdomains or via DNS-TXT fallback domains, writes it to a temporary directory, sets executable permissions, and runs it detached using system shell commands. The package masquerades as an API client for internal payments but performs OS-specific remote code execution unrelated to its described functionality.