The npm package 'cards-forms-clone-cards-core-clone' version 35.4.9 contains malicious code that downloads and executes a hidden payload from obfuscated, platform-specific URLs. The payload is saved to a temporary file with disguised filenames and executed detached from the main process. The package uses string-fragment obfuscation and environment variable checks to evade detection and masquerades its telemetry activity as legitimate. This behavior is unrelated to the package's advertised functionality as a base framework module.