The npm package 'cards-forms-clone-debit-clone' version 35.8.6 contains malicious code that, upon require(), loads a script which reconstructs obfuscated command-and-control (C2) hostnames. It downloads a platform-specific binary to temporary directories under decoy filenames, sets executable permissions, and executes it without verifying the integrity of the downloaded file. The C2 communication and payload delivery are concealed using fragmented hostnames and fallback DNS-TXT queries. No official patch or remediation guidance is available.