The npm package 'twork-products-taiga2-products-investment' version 20.2.8 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts. This binary is saved to a disguised temporary path and executed detached from the main process. Additionally, a second malicious dropper is embedded under the guise of an analytics SDK. Installation or execution of this package results in full compromise of the host system, potentially exposing all stored secrets and keys.