The npm package travel-core-utils-object version 20.3.4 contains malicious code that, upon loading, downloads and executes an attacker-controlled binary from a rotating set of Cloudflare Workers hosts. This binary is saved to temporary directories with disguised filenames, given executable permissions, and run with the installer's privileges. The package includes telemetry-related environment variable checks and files to disguise its true malicious behavior.