Malicious code in sme-rko-finance-front-operations-providers (npm)

__

Source: amazon-inspector (85709f3e95d677177f1e55976d46cf4e16582e9cf3c1b310a7e67dd09885a743)

On require() of the package, index.js loads bridge.js which assembles Cloudflare Workers subdomain hostnames from split string fragments (oob-worker.cf103-070.workers.dev, cf100-416, cf101-adf.workers.dev) and downloads a platform-specific binary via https.get. The fetched bytes are written to a decoy path under /tmp or %TEMP% (.cache/dotnet_diag_.exe), chmod 0755 on Unix, and executed detached via spawn("/bin/sh",["-c", fp+" &"]) or spawn("cmd",...) on Windows. A DNS-TXT fallback channel resolves shards from wel1.ru (sdk.dl.wel1.ru assembled from fragments) — a count record c. followed by numeric shards . — and reassembles base64-decoded payload bytes when the HTTPS delivery path is blocked. Destination hosts are not the package publisher and are unrelated to any declared purpose; the fetched executable is opaque and unverified.