The npm package 'checkout-context' version 35.5.4 contains malicious code that downloads and executes platform-specific native binaries from obfuscated external domains. It uses techniques such as hostname obfuscation, fallback to DNS TXT record covert channels for payload delivery, and writes persistence files on the host. The package's stated functionality is unrelated to this behavior, indicating deliberate malicious intent.