This malicious npm package, sme-rko-finance-front-operations-widget-domain version 35.8.1, loads a compatibility script that downloads a platform-specific native binary from Cloudflare Workers subdomains. If this download fails, it reconstructs the payload from base64-encoded DNS TXT records from a fallback domain, enabling covert delivery that bypasses HTTP egress restrictions. The binary is saved to temporary directories with disguised names such as '.cache_<hex>' or 'dotnet_diag_<hex>.exe', permissions are set to executable, and it is launched detached via shell commands. The naming conventions and cooldown mechanisms are designed to appear as harmless telemetry, but the actual behavior is execution of attacker-controlled native code on every consumer importing the package.

The malicious package enables remote code execution of attacker-controlled native binaries on any system that imports version 35.8.1 of the package. The use of obfuscated domain names and DNS TXT record fallback allows the attacker to bypass network egress controls and evade static detection. This can lead to full system compromise or unauthorized actions performed by the attacker-controlled code.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using version 35.8.1 of the sme-rko-finance-front-operations-widget-domain package. Consider removing or replacing this package from your dependency tree to prevent execution of malicious code.