The npm package 'checkout-pay-widget-logic' version 35.3.2 contains malicious code that downloads and executes a platform-specific binary from hardcoded Cloudflare Workers hosts and a DNS TXT record fallback. The binary is saved under disguised filenames in temporary directories and executed detached from the parent process. The package includes telemetry-like functions as a cover and runs the dropper by default unless environment variables opt out.