The devplatform-ui-notification npm package version 35.3.6 contains malicious code that downloads and executes a payload from obfuscated Cloudflare Workers hosts. The payload is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. The code uses string concatenation to evade static detection and does not verify the downloaded payload's integrity or authenticity. This behavior is unrelated to the package's intended UI notification functionality.