The dp-owners npm package version 35.2.6 contains malicious code that downloads and executes a binary from obfuscated Cloudflare Workers hosts. The binary is saved under disguised filenames in temporary directories and executed detached from the main process. The malicious behavior is hidden behind a telemetry cover story and uses DNS TXT fallback to evade detection. This activity is unrelated to the package's stated functionality.