The npm package dc-dc-core version 35.3.3 contains malicious code that, upon import, downloads and executes a platform-specific native binary from obfuscated Cloudflare worker hosts. This binary is saved under disguised filenames and executed detached from the main process. The package also uses a DNS-TXT fallback mechanism to reassemble payloads from resolver domains, employing runtime hostname construction to evade static detection. The malicious behavior is concealed under telemetry-related naming and environment variable gating. There is no known patch or fix available, and no known exploits in the wild have been reported.