The npm package sme-rko-finance-front-operations-penalty version 35.8.1 contains malicious code that executes automatically upon import. It reconstructs Cloudflare Workers hostnames from obfuscated string arrays to fetch platform-specific binaries, which it writes to temporary directories and executes detached. The package uses obfuscation techniques such as string concatenation and disguised filenames to evade detection. A fallback DNS TXT channel is used if HTTPS fetching fails, indicating persistence mechanisms. This behavior classifies the package as a malicious dropper.