The npm package 'checkout-mobile-promocode' version 35.6.9 contains malicious code that, upon import, downloads and executes attacker-controlled native binaries. It reconstructs obfuscated hostnames to evade static detection, fetches unverified executables from multiple remote endpoints, writes them to temporary directories under disguised filenames, sets executable permissions, and spawns them detached. This behavior occurs immediately on require/import, masquerading as a legitimate mobile checkout or promo code component.