The npm package delivery-ci-microforms version 35.3.5 contains malicious code that auto-executes attacker-controlled binaries upon installation or require. It fetches opaque binaries from ephemeral Cloudflare Workers endpoints or DNS TXT records, writes them to temporary directories under deceptive names, sets executable permissions, and spawns them detached from the main process. The package uses obfuscation techniques to evade static detection and disguises the malicious activity under an 'analytics' cover story. This behavior results in arbitrary code execution on the installer's machine without explicit user consent.