The npm package 'checkout-subscription-holder' version 35.7.1 contains malicious code that downloads and executes a platform-specific binary from suspicious external hosts. The binary masquerades as a diagnostic tool and is stored in temporary directories before execution. The package's advertised functionality is unrelated to this behavior, indicating deliberate malicious intent.