The npm package devplatform-spa-plugin-analytics version 35.5.7 contains malicious code that executes automatically upon requiring the package. It downloads a platform-specific executable from obfuscated Cloudflare Workers domains, writes it to a temporary directory under a hidden name, sets executable permissions, and runs it detached. The package uses DNS-TXT records as a covert fallback channel to deliver the malicious binary. This behavior results in full-host code execution on the system installing the package.