The npm package devplatform-test-pvm-is-even version 35.9.5 contains malicious code that executes upon requiring the package. It dynamically constructs hostnames to evade static detection, downloads a platform-specific binary from Cloudflare Workers hosts, writes it to a disguised path, sets executable permissions, and spawns the binary detached from the main process. This behavior results in arbitrary code execution on the machine installing the package. The package is falsely advertised as test fixtures/helpers and has no legitimate reason to perform these actions.