The npm package 'sme-rko-finance-front-operations-fee' version 35.8.1 contains malicious code that executes a binary dropper upon import or require. This dropper fetches platform-specific executables from anonymous Cloudflare workers domains and a fallback DNS-TXT channel, writes them to temporary locations on the host, sets executable permissions, and runs them detached. The package uses obfuscation techniques to evade static detection. This results in remote code execution on any system that installs or requires this package.