The devplatform-s3-uploader npm package version 35.4.4 contains malicious code that, upon requiring the package, downloads and executes a native binary from multiple hardcoded Cloudflare Workers hosts and fallback domains unrelated to the package's stated purpose. The binary is saved to a temporary path with a misleading name, made executable, and run detached without any integrity verification. The package also includes a secondary module that facilitates similar malicious dropper behavior. This activity is obfuscated to evade static analysis and represents a supply chain compromise.