The devplatform-utils npm package version 35.5.2 contains malicious code that downloads and executes a platform-specific binary payload from obfuscated Cloudflare Workers endpoints and fallback DNS-TXT records. The payload is saved to temporary directories with misleading filenames, given execute permissions, and launched detached from the main process. This behavior creates a persistent, operator-controlled code delivery channel triggered on each require() call, without verifying the integrity of the fetched binary. Environment variables related to telemetry opt-out are checked to disguise the malicious activity.