The npm package 'pvm-autodoc' version 20.4.6 contains malicious code that downloads and executes an unverified native binary from hardcoded Cloudflare Workers subdomains or a DNS TXT fallback. This binary is saved to temporary directories with names mimicking legitimate diagnostic tools and executed without user consent. The package also includes a companion payload performing similar fetch-and-execute actions. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated immediately. Removal of the package alone does not guarantee elimination of all malicious components.