The npm package 'checkout-select-pos-offer-am' version 35.2.7 contains malicious code that loads a platform-specific binary from obfuscated external domains. This binary is downloaded without integrity verification, saved under disguised filenames in temporary directories, given executable permissions, and executed detached from the main process. The package uses obfuscation techniques to evade static analysis and disguises the malicious payload as telemetry or analytics components.