The npm package 'checkout-test-component' version 35.9.8 contains malicious code that, upon being required, downloads and executes attacker-controlled platform-specific executables. These executables are fetched from Cloudflare Workers domains and fallback DNS hosts, saved under deceptive filenames in temporary directories, given executable permissions, and run detached from the main process. The package masquerades as a benign test utility but solely functions to drop and run malicious payloads on the host system.