The npm package statist-browser-typed-client-mb.product.payments version 20.1.9 contains malicious code that downloads and executes opaque native binaries from obfuscated Cloudflare Workers hosts and via DNS TXT records. The package acts as a native dropper, writing and executing files with deceptive names without any integrity verification. This behavior is unrelated to the package's advertised payment functionality and uses covert channels to bypass egress restrictions. Any system with this package installed should be considered fully compromised.