The npm package 'invest-module-cookie' version 20.8.2 contains malicious code that downloads and executes an opaque binary payload from obfuscated external hosts. The payload is fetched using a covert DNS-TXT channel fallback, saved to temporary directories under disguised names, given executable permissions, and then executed. The package's stated purpose as a reusable cookie module is deceptive, and the publisher identity does not match the domains hosting the payload.