The npm package nj-logger contains malicious code that downloads and executes a Windows-specific trojan (W64.AIDetectMalware / Trojan.Malware.300983.susgen) from a remote server. The malicious downloader is obfuscated and disguised as a telemetry module, using base64 and XOR encoding for URLs and paths. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removing the package alone may not eliminate the threat due to potential full system compromise.