The devplatform-spa-plugin-module-loader npm package version 35.8.5 contains malicious code that, upon require, downloads and executes a platform-specific binary from obfuscated and anonymous Cloudflare Workers hosts. The binary is saved to temporary system directories and executed in a detached process. The code uses DNS-TXT record fallback and obfuscation techniques to evade detection. The behavior is disguised as telemetry with an opt-out environment variable, but no legitimate telemetry code is present. This is a supply chain compromise involving a malicious package.