The npm package sme-rko-finance-front-operations-domain version 35.8.1 contains malicious code that downloads and executes a native binary from obfuscated hostnames. It uses runtime-assembled domain names and base64-decoded payloads to evade detection and bypass network egress controls. The malicious binary is saved to temporary directories with disguised filenames and executed detached from the main process. A fallback DNS-TXT channel is used to retrieve payloads if HTTPS download fails. The package includes a telemetry module that duplicates the dropper functionality. There is no integrity verification of the downloaded payload, making it opaque and unverifiable.