The npm package 'saas-f-testing' version 20.4.2 contains malicious code that downloads and executes platform-specific binaries from dynamically assembled and obfuscated hostnames without any signature verification. This behavior results in full system compromise, allowing an attacker to gain control over the affected computer. Immediate removal of the package and rotation of all secrets and keys stored on the compromised system are strongly advised.