The devplatform-cli-plugin-test npm package version 35.4.5 contains malicious code that downloads and executes a binary from non-official, mutable hosts. The binary is disguised with names mimicking diagnostic tools and executed detached from the main process. The package reconstructs command-and-control hostnames at runtime to evade detection and does not verify the integrity of the downloaded binary.