The npm package sme-rko-finance-front-payments-currency-payment-domain version 35.8.1 contains malicious code that executes native code on the host machine upon installation or import. The package masquerades as an internal corporate package but is publicly published, using obfuscation techniques to evade detection. It downloads and executes platform-specific binaries from attacker-controlled infrastructure, enabling full host compromise.