The npm package devplatform-api-v2-resources-metadata version 35.7.7 contains malicious code that loads and executes a native binary fetched from obfuscated and anonymous Cloudflare Worker domains. This binary is written to temporary directories with disguised filenames and executed detached from the main process. The package masquerades as a REST API client wrapper but performs unauthorized native code execution, which is inconsistent with its declared functionality.