The npm package web3-token-helper contains malicious code that executes attacker-controlled binaries when its main API function calculateFee() is called. It downloads and runs platform-specific payloads that establish persistence on Windows, Linux, and macOS by impersonating trusted system components. The package's postinstall script is non-functional, so the malicious activity triggers only upon explicit use of the API. Any system with this package installed or running should be considered fully compromised.