The devplatform-nx-devkit npm package version 35.8.5 contains malicious code that, upon being required, downloads and executes a platform-specific binary from multiple obfuscated hostnames. The package masquerades as a development kit but includes no functional devkit code. It writes the binary to temporary directories with decoy filenames and executes it without performing the referenced integrity check. Environment variables suggest an attempt to disguise the dropper as telemetry, but no legitimate telemetry functionality is present.