The devplatform-zod-wip-api@35.9.3 npm package is a malicious typosquatting package that executes attacker-controlled native code upon import. It drops and runs a platform-specific native binary fetched from attacker-controlled servers without any integrity verification, using obfuscated DNS and file names to evade detection. The package re-executes roughly every six hours and includes multiple dropper implementations to maintain persistence and stealth.