The npm package devplatform-create-nx-spa version 35.4.9 contains malicious code that, upon loading, silently downloads and executes an unsigned binary from attacker-controlled Cloudflare Workers and fallback DNS-TXT channels. This behavior is disguised as analytics and uses obfuscation techniques to evade detection. The malicious binary is written to temporary system directories and executed detached from the main process, enabling remote code execution on the host system.