The npm package devplatform-spa-plugin-s3-feature-toggle version 35.7.1 contains malicious code that executes on import. It downloads and runs an unverified native binary from obfuscated Cloudflare Workers subdomains or, if that fails, via a DNS TXT record covert channel. The binary is saved to temporary locations with hidden filenames and executed without signature verification, enabling full remote code execution on the host during npm install or require().