registry / Remote code execution / sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl
sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl
API client wrappers
This report shows the evidence for sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl@35.8.1, the only known version.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete, import-triggered remote code execution chain with concealed payload delivery and detached execution. The absence of npm lifecycle scripts does not mitigate the runtime attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Any runtime import/require of index.js.
Impact
Arbitrary attacker-supplied native code executes under the importing application's user account.
Mechanism
import-time remote payload download, disk drop, chmod, and detached shell execution
Attack narrative
When an application imports this package, index.js suppresses errors while requiring _bootstrap.js. That module requests a platform-specific binary from hard-coded hosts, or reconstructs it from DNS TXT records. If the response exceeds 1000 bytes, it writes the payload to a temporary path, marks it executable on Unix, and starts it through a detached shell or cmd.exe process.
AI rationale
This is a concrete, import-triggered remote code execution chain with concealed payload delivery and detached execution. The absence of npm lifecycle scripts does not mitigate the runtime attack.
Evidence
package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints8