The devplatform-hooks npm package version 35.2.1 contains malicious code that, upon installation or import, downloads and executes a platform-specific payload. It uses obfuscated Cloudflare Workers URLs and a fallback DNS-TXT covert channel to fetch a binary, which is saved under disguised filenames and executed detached from the parent process. This behavior effectively makes the package a remote code execution dropper.