The npm package statist-browser-typed-client-ddp.mentat.ui.web version 20.9.4 contains malicious code that downloads and executes attacker-controlled native binaries on the host system. Upon loading, it detects the OS and architecture, fetches a platform-specific binary from obfuscated URLs, writes it to temporary directories under disguised filenames, sets executable permissions, and runs it detached. A secondary dropper in the package uses obfuscation to evade detection. Any system with this package installed should be considered fully compromised.