The npm package 'checkout-molecule-desktop-status-modal' version 35.9.4 contains malicious code that downloads and executes a native binary from suspicious external hosts during module load. This behavior is unexpected for a UI status-modal helper and involves writing executable files to temporary directories and launching them as detached background processes without integrity verification.