The npm package peter-desktop-peter-big-column version 20.3.2 contains malicious code that downloads and executes a platform-specific binary from obfuscated hostnames. This binary is attacker-controlled and runs detached on the victim system, potentially giving full control to the attacker. The package includes mechanisms to evade static inspection and uses disguised filenames and lockfiles. Systems with this package installed should be considered fully compromised, and all secrets and keys should be rotated from a clean environment.