The npm package checkout-commit-pos-order-am version 35.8.4 contains malicious code that acts as a dropper. Upon loading, it downloads a native binary from hardcoded and dynamically constructed URLs, writes it to disk with disguised filenames, sets executable permissions, and executes it detached from the main process. A similar dropper is included in the package but not currently invoked. This behavior enables covert execution of potentially harmful code on affected systems.