The npm package sme-rko-finance-front-operations-widget-domain version 35.8.1 contains malicious code that, upon being imported, downloads and executes attacker-controlled native binaries. It uses obfuscated domain names and a fallback covert channel via DNS TXT records to evade detection and bypass network egress controls. The malicious payload is stored in temporary directories under disguised filenames and executed detached from the main process, masquerading as benign telemetry activity.