The npm package 'twork-data-services-sme-agent-company-relation' version 20.5.3 contains malicious code that downloads and executes a native binary from multiple external hosts. The package uses obfuscation techniques to evade detection, writes the payload to temporary directories with disguised names, sets executable permissions, and runs it detached from the main process. A secondary dropper labeled as an 'Analytics SDK' also executes arbitrary code. Installation of this package results in full system compromise, requiring immediate secret and key rotation and package removal.