The npm package 'blocks-sahred-atom-mobile-app-bar-action' contains malicious code that downloads and executes a binary payload from obfuscated Cloudflare Workers hosts and fallback domains. The package name is a misspelling of 'shared' and masquerades as a mobile SDK. The malicious payload is saved to temporary directories with disguised filenames and executed, potentially giving full control of the affected system to an attacker. Any system with this package installed should be considered fully compromised, and all secrets and keys should be rotated from a clean environment.