The npm package sme-rko-finance-front-operations-widget-impl version 35.8.1 contains malicious code that downloads and executes a native binary from multiple Cloudflare Workers hosts and fallback domains. The binary is saved to disguised temporary file paths and executed without integrity verification. The malicious behavior is hidden under the guise of telemetry functionality with an opt-out mechanism. This package is not a cloud service and no official patch or remediation guidance is provided.