The npm package sme-rko-finance-front-operations-shared version 35.8.1 contains malicious code that executes at import time. It downloads and runs attacker-controlled binaries from obfuscated Cloudflare worker URLs and a Russian lookalike domain. The package disguises itself as an analytics tool but includes two independent remote code execution paths that spawn platform-specific payloads without verification.