The npm package statist-browser-typed-client-investing.product.loginandauthorization version 20.7.3 contains malicious code that downloads and executes attacker-controlled native binaries on the host system. This occurs through obfuscated hostnames and runtime-constructed child process calls, resulting in full system compromise upon installation and import of the package. Immediate removal and secret/key rotation are strongly advised.