The npm package ded-aa-liza-ded-aa-liza-core (version 35.2.5) is a malicious package that, upon being required, downloads and executes a platform-specific binary from obfuscated Cloudflare Workers endpoints and fallback DNS TXT channels. The binary is saved under disguised filenames mimicking diagnostic tools, made executable, and run detached on the host system. The package falsely advertises itself as providing foundational type definitions but performs no legitimate function other than executing this remote payload.