Malicious npm dropper-cluster packages (routecraft, endpointmap, bytecraft, staticlayer) execute a dropper binary on Windows hosts during npm install, downloading and running an attacker payload from an external server. Part of a five-package cluster (with procwire) using inter-package dependencies; staticlayer serves files server-side to clients matching the dropper's User-Agent.