The npm package 'cnb-cnb-core' version 35.2.7 contains malicious code that downloads and executes a platform-specific executable from obfuscated remote hosts. The malicious loader uses obfuscation techniques to evade detection, including runtime construction of hostnames and fallback to a DNS-TXT covert channel for payload delivery. It disguises its activity as diagnostic telemetry and analytics, but executes attacker-supplied code without any integrity verification.