The npm package 'cards-forms-credit-clone' version 35.9.5 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare workers.dev hosts. This binary is saved under disguised filenames in temporary directories and executed without any integrity verification. The package uses evasion techniques such as hostname fragmentation and DNS-TXT base64 fallback resolution. Any installer requiring this package is exposed to remote code execution controlled by an attacker.