The npm package 'runhelper' version 1.0.0 contains malicious code that, upon being required, loads and executes a native payload disguised as a .jpg file. This payload is staged by its dependency 'imgbundle' and executed in-memory on Windows systems using kernel32 API calls via the 'koffi' FFI. The payload file is deleted after execution, and the module suppresses all errors, hiding its true behavior. The advertised functionality is a cover story; the actual behavior is the execution of attacker-supplied native code in-process.