The devplatform-spa-devtools npm package version 35.2.6 contains malicious code that downloads and executes platform-specific payloads from obfuscated Cloudflare Workers hosts and covert DNS channels. The payloads are saved under disguised filenames and executed without integrity verification. Execution is suppressed under certain environment variables to evade detection. The malicious infrastructure is unrelated to the legitimate package functionality.