The npm package 'cardsmobile-rs-api' version 35.5.6 contains malicious code that downloads and executes a platform-specific executable from obfuscated remote hosts. The package masquerades as an API client SDK but functions as a dropper that writes an executable to temporary directories, sets executable permissions, and runs it via shell commands. It also uses DNS TXT-record fallback channels for alternate communication. The package has no legitimate functionality and is designed to evade static analysis and detection.