The npm package bpm-foundation-test-jest version 35.9.3 is a malicious package that, upon import, downloads and executes an attacker-controlled binary. It constructs destination hostnames dynamically and uses DNS TXT fallback channels to retrieve the payload. The binary is saved under disguised names in temporary directories, given executable permissions, and launched detached from the main process. The package masquerades as a testing utility but performs no legitimate function other than executing the malicious payload.