The prokit-core npm package version 20.6.6 contains malicious code that executes attacker-controlled native binaries on the host system upon installation or import. It downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains or via a DNS-TXT covert channel, writes it to temporary storage with disguised filenames, sets executable permissions, and runs it detached. The package uses a freshness marker to avoid repeated execution and disguises this behavior as telemetry.