The npm package 'volna-boxy-di-test' version 20.3.8 contains malicious code that downloads and executes platform-specific payloads from command and control (C2) servers. It disguises its activity as telemetry and analytics, uses obfuscated hostnames and filenames, and attempts to evade detection by suppressing re-execution. Installation of this package can lead to full system compromise.