The npm package statist-browser-typed-client-test.jumpwork.circuitbreaker version 20.8.2 contains malicious code that executes attacker-controlled native binaries on the host machine. Upon requiring the package, it downloads and runs native binaries from obfuscated Cloudflare Workers hosts or via a DNS-TXT covert channel, writing files to temporary directories and executing them detached. This behavior indicates intentional evasion and full compromise of any machine installing or running the package. Immediate removal and secret/key rotation are recommended, but full remediation cannot be guaranteed due to potential persistent compromise.