The npm package devplatform-jscodeshift-transforms version 35.9.5 contains malicious code that, upon being required, downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts. The binary is saved under disguised names in temporary directories and executed detached from the main process. If HTTPS retrieval fails, the loader uses a DNS-TXT covert channel to reconstruct the executable. The code uses obfuscation techniques to evade static analysis and disguises itself as benign analytics software.