The npm package devplatform-markdown version 35.9.6 contains malicious code that downloads and executes attacker-controlled binaries on the host system. It fetches platform-specific binaries from obfuscated Cloudflare workers.dev domains and uses DNS-TXT fallback under *.dl.wel1.ru. The binaries are saved with disguised filenames in temporary directories, given executable permissions, and executed detached from the main process. The package also creates a local marker file and respects certain environment variables to simulate telemetry behavior. Any process requiring this package will execute the malicious payload.