The package @esbuild/darwin-arm64 version 0.27.0 contains an embedded executable package/bin/esbuild, which is expected for this type of package as it is a darwin-arm64 executable distributor. The extension mismatch and high entropy trailer are suspicious, but not enough to classify the package as malware, especially given the legitimate use case. The YARA rule match high_entropy_trailer is low confidence, and could be a false positive.