The npm package 'checkout-mobile-input-card' version 35.7.7 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers subdomains. The payload is reconstructed using a DNS TXT record covert channel and executed on the host system, masquerading as cache or diagnostic files. The package name mimics a legitimate payment component to evade detection.