The npm package 'checkout-desktop-promocode' version 35.4.3 contains malicious code that, when imported, downloads and executes attacker-controlled binaries on the host system. It masquerades as a promocode SDK but performs no legitimate functionality. Instead, it fetches binaries from obfuscated, author-controlled domains using covert DNS-TXT fallback channels, writes them to temporary directories with innocuous filenames, sets executable permissions, and runs them detached via shell commands. This results in arbitrary code execution on the installer's machine.