The devplatform-spa-ui npm package version 35.8.2 contains malicious code that downloads and executes a binary payload from external hosts. This behavior is hidden behind obfuscated runtime string assembly to evade detection. The payload is written to a temporary hidden path and executed detached from the main process. The malicious actions are unrelated to the package's advertised purpose as a SPA UI toolkit and lack any integrity verification of the downloaded binaries.