The 'sme-rko-finance-front-operations-fee' npm package version 35.8.1 includes malicious code in its main entry point and a vendor module that execute a binary dropper at require/import time. The dropper reconstructs hostnames and API identifiers from split strings to evade static analysis and dynamically requires system modules like 'child_process' and 'fs'. It fetches platform-specific executables from anonymous Cloudflare workers.dev origins and a base64 DNS-TXT fallback channel under the domain '*.dl.wel1.ru'. The fetched binaries are saved to temporary directories on Linux or Windows, permissions are set to executable, and the binaries are spawned detached using shell commands. There is no pinning or signature verification of the fetched binaries, and the hosting domains are mutable and anonymous. This behavior leads to remote code execution on the host machine upon installation or requiring of the package.

Installing or requiring the affected version 35.8.1 of the 'sme-rko-finance-front-operations-fee' package results in remote code execution on the host system. The malicious dropper downloads and executes arbitrary binaries from anonymous and mutable sources without verification, potentially allowing attackers to execute any code with the privileges of the user running the package. This poses a critical security risk including system compromise.

No official patch or remediation is currently documented. Users should avoid installing or requiring version 35.8.1 of the 'sme-rko-finance-front-operations-fee' package. Verify package integrity and source before use. Monitor for updates or advisories from the package maintainers or trusted security sources for remediation guidance. Consider removing the package from existing environments to prevent exploitation.