The npm package sme-rko-finance-front-operations-income version 35.8.1 contains malicious code that, upon import, reconstructs attacker-controlled hostnames to download and execute a platform-specific native binary. This binary is saved to temporary directories with disguised filenames and executed detached from the parent process. A covert fallback channel uses DNS TXT records to deliver the executable, bypassing HTTPS-based network filtering. The package falsely advertises monitoring functionality but solely acts as a remote code execution dropper.