The npm package devplatform-rest-resources-v2 version 35.9.7 contains malicious code that downloads and executes opaque binary payloads from multiple external hosts. The payloads are fetched over HTTPS from Cloudflare Workers and fallback DNS TXT records, then written to temporary directories with disguised filenames, made executable, and spawned as detached processes. This behavior is unrelated to the package's declared purpose and indicates a malicious dropper mechanism embedded within the package.