The npm package 'checkout-use-toasts' version 35.3.6 contains malicious code that downloads and executes attacker-controlled native binaries from obfuscated Cloudflare workers and DNS-TXT record channels. This behavior is inconsistent with the package's stated purpose and results in remote code execution on the installer's machine.