The devplatform-eslint-plugin-nx package version 35.6.5 is a malicious typosquatting npm package that impersonates @nx/eslint-plugin. When required, it downloads a platform-specific binary from obfuscated Cloudflare Workers hosts or fallback domains, writes it to temporary directories under disguised names, sets execution permissions, and executes it. The package uses obfuscation techniques to evade static detection and includes telemetry features to mask its activity. A secondary unused payload with similar capabilities is also included in the package.