The npm package sme-rko-finance-front-payments-allowed-tariffs-filter version 35.8.1 contains malicious code that executes arbitrary binaries downloaded from multiple obfuscated external hosts. Upon requiring the package, it downloads an opaque binary to temporary directories, sets executable permissions, and runs it detached, enabling full host code execution. The package masquerades as a finance-related UI component but performs unrelated malicious actions without version pinning, signature verification, or user configuration.