The npm package devplatform-spa-di version 35.5.8 contains malicious code that loads a native binary from hardcoded Cloudflare Workers subdomains and fallback DNS TXT records. This binary is written to temporary storage and executed without verification, under the guise of telemetry functionality. The package's stated purpose is a small SPA dependency-injection helper, unrelated to native binary execution.