The npm package 'checkout-test-utils' version 35.1.3 contains malicious code that automatically downloads and executes attacker-controlled binaries from obfuscated Cloudflare Workers hosts. The package disguises its payload download and execution to evade detection, writing binaries to temporary files and running them without verification. Any user installing or requiring this package will inadvertently execute this malicious code on their host system.