The npm package digital-interview-digital-interview-core version 20.5.3 contains malicious code that downloads and executes arbitrary binaries from obfuscated external hosts without verification. This behavior results in arbitrary remote code execution on the host machine at load time. The malicious payload masquerades as legitimate telemetry files and evades static analysis through string obfuscation. Systems with this package installed should be considered fully compromised, and all secrets on those systems should be rotated immediately.