The npm package sme-rko-finance-front-operations-pegasus version 35.8.1 contains malicious code that downloads and executes a platform-specific binary from suspicious external hosts. It uses obfuscated techniques to evade static detection, including dynamic hostname assembly and string concatenation for API calls. The package's legitimate purpose is data transformation, which does not justify this behavior. There is no known patch or official fix available at this time.