The devplatform-integrations-tests-lib npm package version 35.2.5 contains malicious code that downloads and executes a native binary from suspicious Cloudflare workers.dev hosts and fallback domains. The malicious payload is written to temporary system directories with filenames mimicking legitimate system artifacts and executed in a concealed manner. This behavior is hidden within the package's bootstrap and telemetry modules, which act as a cover for the dropper functionality.