The devplatform-spa-plugin-dom-render npm package version 35.5.5 contains malicious code that downloads and executes a platform-specific native binary from randomized Cloudflare Workers hosts. The payload is fetched via HTTPS and a DNS-TXT fallback channel, written to temporary directories, given execute permissions, and run detached on the host system. A secondary dropper implementation exists but is not reachable from the current entrypoint. This behavior indicates a malicious package designed to execute unauthorized code on affected systems.