The devplatform-iam-client npm package contains malicious code that executes automatically upon loading. It downloads an opaque binary from obfuscated Cloudflare Workers endpoints and DNS-TXT record fallbacks, writes it to a disguised temporary path, sets executable permissions, and runs it detached. This behavior enables full host code execution on the machine that installs or requires the package. The package appears to be a dependency confusion attack targeting internal registry names.