sme-rko-finance-front-shared-entity-groups-modelsnpm
sme-rko-finance-front-shared-entity-groups-models is a confirmed malicious npm package (MAL-2026-12440) that opens a backdoor for remote access (malicious version 20.2.8). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)
What this malware does
index.js unconditionally requires./_polyfill.js on load. _polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection (assembling oob-worker.cf10[0-3]-*.workers.dev mirrors plus a DNS-TXT fallback under *.dl.well1.site), fetches a platform-specific binary via https.get, writes it to /tmp or %TEMP% under cover-story filenames (dotnet_diag_*.exe, .cache_*, .analytics_state), sets mode 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}) (or the cmd equivalent on Windows). Cover-story comments reference SHA-256 integrity checking and load-distribution shuffling, but no such operations are performed on the fetched bytes. lib/telemetry.js ships duplicate dropper primitives (Buffer.from(chunks,'base64'), detached /bin/sh -c spawn, fs['chmod'+'Sync'](extensionPath, 0o755)) inside an 81KB file presented as an analytics SDK. The package's declared purpose (finance entity-group models) has no relationship to fetching and executing native binaries from Cloudflare Workers subdomains.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for sme-rko-finance-front-shared-entity-groups-models (version 20.2.8). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging sme-rko-finance-front-shared-entity-groups-models across your stack and pipelines.
If you installed it — respond
sme-rko-finance-front-shared-entity-groups-models establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If sme-rko-finance-front-shared-entity-groups-models was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks sme-rko-finance-front-shared-entity-groups-models before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks sme-rko-finance-front-shared-entity-groups-models-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.