The npm package 'distributorblock' version 35.8.1 contains malicious code that downloads and executes a native binary from hardcoded Cloudflare Workers hosts. It uses a decoy telemetry module and employs a covert DNS TXT record fallback channel to retrieve payloads, bypassing HTTP egress controls. The binary is saved to temporary directories and executed detached to evade detection. The package's declared purpose is inconsistent with this behavior, and author metadata is missing, indicating a trojan dropper designed to evade sandboxing and network defenses.