The npm package sme-rko-finance-front-operations-notifications-models version 35.8.1 contains malicious code that downloads and executes opaque native binaries from anonymous Cloudflare Workers subdomains. The package's index.js loads _polyfill.js and lib/telemetry.js, which act as native-binary droppers, assembling hostnames and API names dynamically to evade static detection. The binaries are written to temporary directories, given execute permissions, and spawned detached to run on the host system. This behavior contradicts the declared purpose of the package as core infrastructure utilities or telemetry.