The npm package devplatform-spa-plugin-root-devtools version 35.5.6 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts. The package uses covert DNS-TXT queries to reassemble a base64-encoded payload, which is then written to temporary directories and executed without integrity verification. The malicious payload is unrelated to the package's stated purpose and attempts to evade static analysis by dynamically constructing hostnames.