The devplatform-cli-plugin-generator npm package version 35.3.5 contains malicious code that downloads and executes platform-specific binaries from non-publisher hosts without integrity verification. The malicious payload is obfuscated and disguises itself as telemetry functionality, reconstructing hostnames and API names to evade analysis. It writes executables to temporary directories and executes them detached from the main process.