The npm package devplatform-spa-plugin-thermostat version 35.9.9 contains malicious code that, upon require, downloads and executes a binary payload from rotating Cloudflare Workers subdomains and fallback DNS-TXT records. The binary is saved under disguised filenames in temporary directories and executed without any hash or signature verification. The package masquerades as a thermostat SPA plugin, but the downloaded payload and infrastructure are unrelated to its stated purpose.