The npm package statist-browser-typed-client-jumptaxi.feature.contacts version 20.7.7 contains malicious code that, upon import, downloads and executes an attacker-controlled native binary on the host system without verification. The payload is fetched from dynamically constructed Cloudflare worker domains and a DNS TXT covert channel fallback, saved under deceptive filenames in temporary directories, made executable, and launched detached. This results in automatic execution of arbitrary native code on the installer's machine.