The npm package cardsmobile-notifications version 35.7.6 contains malicious code that downloads and executes OS/architecture-specific binaries from obfuscated Cloudflare Workers endpoints using covert DNS TXT record channels. The binaries are saved under disguised filenames in temporary directories and executed without any integrity verification. An additional dormant module mimics telemetry functionality but contains similar malicious execution patterns. No official patch or remediation guidance is currently available.