The npm package saas-f-lego-landings version 20.7.5 contains malicious code that executes a native binary dropper upon loading. This dropper fetches a platform-specific executable from obfuscated Cloudflare Workers hosts or via a DNS TXT-record fallback, writes it to temporary directories with deceptive filenames, sets executable permissions, and runs it detached. The package also includes a large telemetry-like module with similar dropper behavior, supporting the presence of a staged loader. These behaviors indicate intentional malicious activity rather than legitimate functionality.