The npm package 'sme-rko-finance-front-payments-feed-display-list' version 35.8.1 contains malicious code that downloads and executes platform-specific binaries without verification. It dynamically constructs URLs to fetch executables from anonymous worker subdomains, writes them to temporary files with decoy names, sets executable permissions, and runs them detached. If the HTTP fetch fails, it falls back to reconstructing the payload from DNS TXT records. This behavior is inconsistent with the package's benign finance-related name and indicates malicious intent.