The npm package 'hubert-application-get-document-preview-am' version 20.4.6 contains malicious code that downloads and executes a native binary from hardcoded external endpoints. It uses obfuscation techniques such as runtime hostname reconstruction and a DNS-TXT fallback channel to evade detection. The payload is written to temporary directories with deceptive filenames, given executable permissions, and executed detached from the main process. A secondary dropper in the package provides an alternate execution path. Any system with this package installed should be considered fully compromised, and all secrets on that system should be rotated immediately.