Supply chain · npm · High

Critical Malicious npm Package: 'sme-rko-finance-front-payments-domain' Downloads Binaries

Threat Engine Auto-Feed · data current as of 2026-08-08

A critical malicious package, 'sme-rko-finance-front-payments-domain' version 35.8.1, has been identified in the npm ecosystem. Upon being required, it downloads and executes an OS-specific binary from remote servers, posing a significant supply-chain risk to any environment where it is installed.

  • Package: npm / sme-rko-finance-front-payments-domain
  • Affected versions: = 35.8.1
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Malicious package

The npm package 'sme-rko-finance-front-payments-domain' version 35.8.1 contains malicious code. When the package is required, it initiates a process to download an operating system-specific binary from a set of concealed command-and-control (C2) hostnames. This binary is then saved to a temporary directory with a disguised name and executed in a detached manner.

How the attack works

This is a malicious package attack where a seemingly legitimate or internal-looking package introduces harmful functionality. The attack leverages dynamic code execution at package load time to fetch and run external binaries. The use of fragmented strings for C2 hostnames and a lack of integrity verification for downloaded binaries are notable characteristics of this method.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest package versions
  • Any system or developer workstation that has installed 'sme-rko-finance-front-payments-domain' version 35.8.1

Conditions that increase exposure

  • Direct or transitive dependency on 'sme-rko-finance-front-payments-domain' version 35.8.1
  • Lack of package lockfiles or dependency pinning in projects
  • Using internal package mirrors that do not vet packages for malicious content
  • Environments where downloaded binaries can be executed without strict sandboxing or permissions

Blast-radius scenarios

  • If installed, the package allows an attacker to execute arbitrary code on the host system via the downloaded binary, potentially leading to system compromise, data exfiltration, or further network penetration.
  • The blast radius extends to any system where the package is built, tested, or deployed, including developer machines, build servers, and production environments.

What to do (defensive)

Detect

  • Scan dependency trees for 'sme-rko-finance-front-payments-domain' version 35.8.1.
  • Monitor network traffic for connections to known C2 hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, sdk.dl.wel1.ru).
  • Look for unexpected file writes and executions in temporary directories (e.g., /tmp or %TEMP%) with disguised names like '.cache_<hex>' or 'dotnet_diag_<hex>.exe'.

Contain

  • Immediately quarantine or isolate any systems identified with the malicious package installed.
  • Block network access to the identified C2 hostnames at the perimeter.
  • Prevent new installations of 'sme-rko-finance-front-payments-domain' version 35.8.1 in package registries or mirrors.

Remediate

  • Remove 'sme-rko-finance-front-payments-domain' version 35.8.1 from all projects and environments.
  • Perform a thorough forensic analysis on affected systems to identify the extent of compromise and any persistence mechanisms.
  • Update dependency management practices to include pinning versions and using lockfiles to prevent unexpected package updates.
  • Implement stricter supply chain security controls, such as package integrity verification and runtime monitoring for suspicious behavior.

Frontier verdict — High

Prioritize immediate detection and removal of 'sme-rko-finance-front-payments-domain' version 35.8.1 due to its critical severity and direct binary execution capability.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.