The devplatform-cli npm package version 35.7.4 contains malicious code that executes arbitrary binaries on the user's system upon installation or import. It downloads platform-specific binaries from suspicious, anonymous serverless hosts, writes them to temporary directories with disguised filenames, sets executable permissions, and spawns them in the background. This behavior occurs without verification of the downloaded content and is triggered automatically unless an opt-out environment variable is set.