The npm package 'cards-forms-cards-core-clone' version 35.3.2 is a malicious package that executes a dropper upon import. It reconstructs command-and-control (C2) hostnames and downloads a platform-specific executable, which it writes to temporary directories and executes detached from the main process. If the primary C2 hosts are unreachable, it uses a DNS-TXT-based fallback to retrieve a base64-encoded payload. The package mimics a legitimate forms/cards library but contains no legitimate functionality beyond executing malicious code.