The devplatform-nx-ts npm package version 35.1.3 contains malicious code that downloads and executes platform-specific binaries from dynamically constructed Cloudflare Workers domains and a DNS-TXT fallback channel. These binaries are saved to temporary directories under disguised filenames, given executable permissions, and executed detached from the main process. The package includes a secondary telemetry module capable of a similar drop-and-execute behavior, though it is not invoked in the current version. There is no verification of the downloaded binaries, and the malicious behavior is disguised as telemetry functionality.