The npm package 'checkout-molecule-mobile-status-sheet' version 35.7.9 contains malicious code that, upon require(), downloads and executes a platform-specific executable from obfuscated Cloudflare Workers hosts. It writes the executable to temporary directories under decoy names, sets executable permissions, and runs it detached. A DNS-TXT fallback channel from several domains provides covert payload delivery if HTTP egress is filtered. The package name is deceptive and unrelated to its malicious behavior.