The npm package 'checkout-desktop-legal' version 35.2.8 contains malicious code that downloads and executes a binary from dynamically constructed Cloudflare Workers hosts and fallback domains. The binary is saved under disguised filenames with executable permissions and launched detached from the main process. The package uses obfuscation techniques such as string concatenation to evade static detection. A second similar dropper is embedded in another module within the package. This behavior enables periodic re-execution approximately every six hours.