The npm package 'checkout-input-email-logic' version 35.8.2 contains malicious code that downloads and executes attacker-controlled native binaries on the host machine. This occurs without any hash or signature verification and is triggered upon requiring or installing the package. The malicious code uses obfuscated hostnames and environment variables to evade detection and conditionally execute. No official patch or remediation guidance is currently available.