The npm package devplatform-spa-route-tree version 35.1.3 contains malicious code that dynamically downloads and executes a platform-specific binary from obfuscated Cloudflare Workers subdomains and fallback domains. The binary is saved to temporary directories, masquerades as .NET diagnostic tooling, and is executed detached from the main process. The downloaded binary is unverified and served from infrastructure unrelated to the package publisher, indicating a supply chain compromise or intentional malicious behavior.