The npm package tcb-web-copy-to-clipboard version 20.1.2 contains malicious code that fetches and executes an attacker-controlled binary at runtime. The package masquerades as a clipboard SDK but downloads an unverified executable from dynamically assembled Cloudflare Workers hosts, saves it under a disguised name in temporary directories, sets executable permissions, and runs it detached. This behavior is hidden behind obfuscated domain assembly and a false telemetry opt-out mechanism. The fetched executable is unrelated to clipboard functionality and poses a security risk.