The npm package 'checkout-get-installment-client-agreement-am' version 35.1.4 contains malicious code that executes upon module load. It detects the host OS and architecture, constructs obfuscated Cloudflare Workers hostnames, and downloads a platform-specific binary payload. This payload is saved under disguised filenames in temporary directories, given executable permissions, and executed detached without signature or hash verification. The code masquerades as telemetry/analytics but exhibits suspicious behavior inconsistent with such claims.