The npm package 'checkout-use-notifications' version 35.6.1 contains malicious code that, upon requiring the package, loads a script which fetches a platform-specific binary payload from obfuscated Cloudflare Workers hosts. The payload is delivered using a DNS TXT-record fallback channel and is saved to temporary directories under disguised filenames before execution. This behavior is characteristic of a malicious dropper designed to evade detection and persist on the system.