The npm package afisha-storybook-default contains malicious code that, when required, downloads and executes attacker-controlled binaries from obfuscated remote hosts. It uses base64-decoded payloads saved to temporary directories and executes them with elevated permissions. The package masquerades as a storybook default adapter but performs no legitimate functions, instead acting as a remote binary dropper that collects host-specific fingerprint data and transmits it to attacker infrastructure.