The npm package 'checkout-public-tokens' version 35.4.9 contains malicious code that downloads and executes an opaque binary payload from obfuscated, hardcoded external hosts. The payload is saved to temporary directories under disguised filenames, given executable permissions, and launched detached from the main process. The package falsely claims the download is for telemetry and analytics, but no verification of the downloaded content is performed.