The devplatform-spa npm package version 35.1.4 contains malicious code that downloads and executes OS-specific binaries from Cloudflare Workers endpoints and fallback domains. This code writes the binaries to temporary directories under disguised filenames, sets executable permissions, and runs them detached from the main process. The malicious loader is invoked unconditionally on every require call, masquerading as telemetry with opt-out checks and no-op logging stubs.