The npm package pfp-forms-sme-loan version 20.2.1 contains malicious code that, upon requiring the package, downloads and executes attacker-controlled binaries from obfuscated Cloudflare Workers subdomains. The payload is fetched using runtime-assembled hostnames and a DNS TXT record fallback, then saved to a temporary file with disguised names, made executable, and run detached on the host system. This results in arbitrary code execution on the installer's machine.