The npm package devplatform-prettier-config version 35.1.3 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers subdomains or, if that fails, via covert DNS TXT-record channels. The payload is saved to deceptive filenames on the local system and executed without hash or signature verification. This behavior is unrelated to the legitimate prettier or JavaScript tooling ecosystem and is designed to evade detection by suppressing repeated runs via a lock file.