The npm package 'sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models' version 35.8.1 contains malicious code that downloads and executes payloads from multiple Cloudflare Workers endpoints. The payload is saved in temporary directories with disguised filenames and executed in a detached manner to evade detection. The malicious behavior includes runtime reconstruction of API names and hostnames to avoid static analysis and redundant payload delivery mechanisms. This threat involves a dropper that stages payload delivery and uses filesystem stamps to avoid repeated execution.