The npm package dws-frontend-dws-frontend-core version 35.4.3 contains malicious code that downloads and executes a platform-specific binary from author-controlled external hosts. The binary is saved to disguised filenames on the local system and executed without integrity verification. The package attempts to evade detection by assembling hostnames dynamically and pretending to respect telemetry opt-out environment variables, though it actually performs remote binary execution.