The npm package delivery-ci-unit version 35.9.3 contains malicious code that, upon require, reconstructs attacker-controlled hostnames to fetch and execute a platform-specific binary without signature verification. The binary is saved in disguised filenames mimicking system caches and executed detached from the main process. The package uses environment checks and DNS TXT covert channels for evasion and fallback delivery. This behavior is unauthorized and not related to the package publisher.