The npm package 'checkout-desktop-cashback' version 35.4.6 contains malicious code that loads a vendor script which fetches and executes a platform-specific binary from obfuscated and anonymous Cloudflare Workers endpoints. The binary is delivered via covert channels including DNS-TXT records and is saved to temporary directories under disguised filenames before execution. This behavior occurs on every consumer that requires this package, potentially leading to unauthorized code execution.