The npm package 'checkout-pay-button-logic' version 35.3.8 contains malicious code that, upon requiring the package, downloads and executes a native binary payload from obfuscated Cloudflare Workers hostnames and fallback DNS-TXT resolvers. The payload is saved to temporary directories with deceptive filenames and executed detached from the main process. The malicious code attempts to mimic legitimate telemetry opt-out behavior but is unrelated to the package's stated functionality.