The npm package 'cards-forms-debit-clone' version 35.2.3 contains malicious code that, upon import, downloads and executes a platform-specific binary from anonymous worker subdomains. The binary is saved to temporary directories under disguised names and executed without signature or hash verification. If the primary HTTPS download fails, a fallback mechanism uses DNS TXT records to reconstruct and execute a base64-encoded payload. This behavior is disguised as telemetry with a nominal opt-out, posing a risk of arbitrary code execution.