The npm package checkout-cashback-logic version 35.4.3 contains malicious code that silently loads a bootstrap script. This script reconstructs Cloudflare Workers subdomains and a DNS TXT fallback channel to download a platform-specific native executable. The executable is saved under hidden or misleading filenames in temporary directories, made executable, and then run detached on the host system without integrity checks. This behavior is unrelated to the package's stated functionality and is designed to evade static analysis. Any use of this package results in execution of attacker-controlled code on the host.