The devplatform-spa-plugin-query npm package version 35.8.5 contains malicious code that, upon being required, downloads and executes a platform-specific payload from a command-and-control server. The payload is fetched over HTTPS without any hash or signature verification and is executed with elevated permissions. A covert DNS-TXT fallback channel is also used to retrieve data if HTTPS is blocked. This behavior enables remote code execution through the malicious package.