OpenSSF/OSV advisory MAL-2026-13646 confirms this npm version as malicious. On require() of the package, index.js loads _bridge.js which assembles Cloudflare Workers subdomain hostnames from split string fragments (oob-worker.cf103-070.workers.dev, cf100-416, cf101-adf.workers.dev) and downloads a platform-specific binary via https.get. The fetched bytes are written to a decoy path under /tmp or %TEMP% (.cache_<hex>/dotnet_diag_<hex>.exe), chmod 0755 on Unix, and executed detached via...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in sme-rko-finance-front-operations-providers (npm)
Details
On require() of the package, index.js loads _bridge.js which assembles Cloudflare Workers subdomain hostnames from split string fragments (oob-worker.cf103-070.workers.dev, cf100-416, cf101-adf.workers.dev) and downloads a platform-specific binary via https.get. The fetched bytes are written to a decoy path under /tmp or %TEMP% (.cache_<hex>/dotnet_diag_<hex>.exe), chmod 0755 on Unix, and executed detached via spawn("/bin/sh",["-c", fp+" &"]) or spawn("cmd",...) on Windows. A DNS-TXT fallback channel resolves shards from wel1.ru (sdk.dl.wel1.ru assembled from fragments) — a count record c.<domain> followed by numeric shards <i>.<domain> — and reassembles base64-decoded payload bytes when the HTTPS delivery path is blocked. Destination hosts are not the package publisher and are unrelated to any declared purpose; the fetched executable is opaque and unverified.
Decision reason
OpenSSF Malicious Packages via OSV confirms sme-rko-finance-front-operations-providers@35.8.1 as malicious (MAL-2026-13646): Malicious code in sme-rko-finance-front-operations-providers (npm)