The npm package claims-use-callback-once version 35.6.7 contains malicious code that downloads and executes a payload from multiple hardcoded Cloudflare Workers hosts and a DNS TXT base64 fallback domain. The payload is saved under deceptive Microsoft-diagnostics-style filenames in temporary directories, given executable permissions, and executed detached from the main process. The package masquerades as a callback utility but includes no legitimate functionality and uses obfuscation techniques to evade static analysis. A parallel dropper implementation is disguised as an 'Analytics SDK'.