The npm package sme-rko-finance-front-operations-holding-domain version 35.8.1 contains malicious code that executes upon require(). It downloads and executes platform-specific native binaries from obfuscated and suspicious hosts, writing them to temporary locations and running them detached from the main process. The package uses string concatenation and array joins to evade static analysis and includes anti-analysis techniques such as endpoint shuffling and cooldown files. The malicious behavior is disguised under a telemetry SDK cover story.