The npm package 'statist-browser-typed-client-twork.tsales.nitro.metrics' version 20.6.2 contains malicious code that loads a platform-specific payload from anonymous Cloudflare Workers subdomains or via a DNS-TXT covert channel. The payload is written to temporary directories under disguised names, made executable, and executed without any integrity verification. The obfuscation and covert delivery mechanisms indicate malicious intent rather than legitimate telemetry.