The npm package 'statist-browser-typed-client-mb.product.operations' version 20.4.9 contains malicious code that downloads and executes a binary payload from dynamically assembled external hosts. The payload is saved under disguised filenames in temporary directories and executed without integrity verification. The package masquerades this activity as telemetry, which contradicts its stated purpose as an Operations SDK.