The npm package hex-encode-utils versions 1.0.0 through 1.0.5 contains malicious code that executes during installation. It fetches an encrypted payload from hardcoded Cloudflare Workers hosts with TLS verification disabled, decrypts it using a hardcoded key, writes it to a local Python file, and executes it in a detached process. The package also sends host information to a Telegram bot. The malicious behavior is disguised as a compatibility shim and includes sandbox evasion checks to avoid detection in CI or container environments.