The npm package sme-rko-finance-front-operations-notifications-impl version 35.8.1 contains malicious code that loads and executes platform-specific payloads from obfuscated external hosts. The payloads are fetched using runtime-assembled hostnames and executed on the system without signature verification, enabling remote code execution. The package name mimics an internal scope to lure victims via dependency confusion.