The npm package 'hubert-document-actual-insurance-rules-am' version 20.5.6 contains malicious code that downloads and executes attacker-controlled binaries upon module load. It disguises its behavior as telemetry by using misleading identifiers and dynamically assembles hostnames to evade static analysis. The malicious binary is fetched from rotating Cloudflare Workers hosts and executed on the host system, potentially compromising the entire computer.