The npm package tramvai-module-feature-toggle version 20.5.3 is a malicious package that drops and executes a platform-specific binary from attacker-controlled Cloudflare Workers hosts. It uses obfuscation techniques to evade detection, including runtime assembly of hostnames and fallback to covert DNS TXT record payload delivery. The package does not provide legitimate functionality and its installation results in full system compromise.