The npm package 'checkout-mobile-input-email' version 35.6.8 contains malicious code that downloads and executes a platform-specific binary from anonymous Cloudflare Workers subdomains. The binary is saved under disguised filenames in temporary directories and executed detached from the main process. The package also uses a secondary exfiltration or download channel via base64-encoded DNS-TXT fallback resolvers. This behavior is unrelated to the legitimate functionality of the package and indicates a supply chain compromise.