The npm package 'claims-format-masked-phone-number' version 35.9.8 contains malicious code that loads a polyfill script which fetches and executes opaque native binaries from hardcoded Cloudflare Workers subdomains. These binaries are saved to temporary directories and executed without any signature verification. A fallback mechanism uses DNS TXT record queries to retrieve and run additional executable code. The package's behavior and included files do not align with its stated purpose of phone-number masking, indicating malicious intent.