The npm package checkout-mobile-cashback version 35.4.9 contains malicious code that executes a staged binary dropper upon module load. It fetches platform-specific binaries from hardcoded Cloudflare Workers URLs and fallback DNS-TXT base64 channels, writes them to temporary directories under disguised system-like filenames, sets executable permissions, and runs them detached without verification. The package disables telemetry logging to conceal this behavior. This malicious activity occurs as a side effect of importing the package.