The npm package ded-pwa-bnpl-forms-demo version 35.9.6 contains malicious code that downloads and executes a binary payload at import time. The payload is fetched from dynamically constructed Cloudflare Workers hosts or via DNS TXT record queries, then written to temporary directories and executed without integrity verification. The dropper masquerades as analytics-related telemetry but performs unauthorized code execution.