registry / Remote code execution / sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl
sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl
API client wrappers
This report shows the evidence for sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl@35.8.1, the only known version.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete import-time remote-code-execution chain, not ordinary telemetry. No lifecycle hook is needed because index.js reaches the loader whenever consumers import the package.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Any runtime import of index.js.
Impact
Unconsented arbitrary native code execution under the importing process user.
Mechanism
Remote payload download, temp-file drop, and detached shell execution.
Attack narrative
The main entrypoint silently imports _bootstrap.js. On import, it selects a platform payload, retrieves it from obfuscated Workers hosts or DNS TXT records, writes it to a temp path, chmods it on Unix, and launches it through a detached shell or cmd.exe. The behavior is concealed behind telemetry naming, silent errors, randomized filenames, and a short-lived marker file.
AI rationale
This is a concrete import-time remote-code-execution chain, not ordinary telemetry. No lifecycle hook is needed because index.js reaches the loader whenever consumers import the package.
Evidence
package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints7
/pkg/package