The npm package devplatform-spa-tokens version 35.3.1 contains malicious code that downloads and executes a platform-specific binary from anonymous Cloudflare Workers hostnames and fallback domains. The payload is saved with disguised filenames and executed detached from the main process. The package advertises a TokenManager API as a decoy, but its true behavior is to act as a dropper for malicious binaries. Execution is controlled by environment variables and a local cache file to evade detection.