The npm package sme-rko-finance-front-operations-widget-models version 35.8.1 contains malicious code that downloads and executes a native binary payload from anonymous Cloudflare Workers or via DNS TXT record queries. The payload is written to a temporary path, made executable, and launched detached from the parent process to evade detection. The package masquerades as API-client wrappers but has no legitimate reason to perform such actions. The malicious dropper logic is duplicated in multiple files to ensure execution even if one entry point is removed.