The npm package 'claims-is-mobile-layout' version 35.4.3 contains malicious code that downloads and executes a native binary from dynamically assembled endpoints. This binary is stored in temporary system directories under misleading names and executed detached from the main process. The package uses obfuscation techniques such as runtime URL assembly and a DNS-TXT covert channel to evade detection. This behavior is unrelated to the package's advertised functionality and indicates a supply chain compromise.