The npm package sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models version 35.8.1 contains malicious code that reconstructs the 'child_process' module and downloads a binary from multiple Cloudflare Workers hosts. This binary is written to temporary directories, given executable permissions, and executed without signature verification. If HTTPS downloads fail, the package uses a DNS-TXT covert channel to retrieve and execute a base64-encoded binary. The malicious code is disguised with comments suggesting telemetry functionality and checks environment variables to avoid detection.