The npm package devplatform-supafetch version 35.2.1 contains malicious code that, upon being required, downloads and executes a native binary payload from hardcoded Cloudflare Workers hosts or via a DNS TXT record fallback. This payload is saved to temporary directories and executed detached, enabling arbitrary remote code execution on the host. The malicious behavior is disguised as optional telemetry using environment variable gating and misleading filenames.