The npm package csc-csc-core version 35.8.6 contains malicious code that, upon requiring the package, downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hostnames. This binary is saved under disguised filenames in temporary directories and executed detached from the main process. The package uses runtime assembly of command and control hostnames and sandbox evasion techniques such as cooldown markers and opt-out flags. The package's README falsely advertises it as a benign base framework module.