The npm package delivery-ci-pipeline-rules version 35.9.3 contains malicious code that, upon installation or import, fetches and executes attacker-controlled binaries from external infrastructure. The malicious script assembles hostnames dynamically to download platform-specific payloads, writes them to temporary locations with disguised names, sets executable permissions, and runs them detached. If HTTPS fetching fails, it uses a DNS-TXT record covert channel to retrieve the payload. This results in arbitrary code execution on the installer's host system.