The npm package statist-browser-typed-client-sme.rko.tariffs.web version 20.3.8 contains malicious code that, upon require(), downloads and executes a platform-specific binary payload from obfuscated command and control servers. The payload is saved with deceptive filenames and executed detached from the parent process. The package uses fallback covert DNS TXT channels if HTTPS fetching fails. There is no integrity verification of the downloaded binary. Systems with this package installed should be considered fully compromised.