The npm package docsmate-docsmate-core version 35.9.3 contains malicious code that, upon import, downloads and executes an OS/architecture-specific binary from obfuscated Cloudflare Workers hostnames and fallback DNS-TXT resolver domains. The binary is saved under a disguised name mimicking a Microsoft.NET diagnostic tool and executed detached from the main process. This behavior is unexpected for a platform/core types library and indicates malicious intent to run unauthorized code on the host system.