The npm package ded-pwa-c-cms version 35.9.9 contains malicious code that downloads and executes an opaque binary from obfuscated, author-controlled hosts. The binary is saved to temporary directories and executed detached from the main process, masquerading as a legitimate Microsoft diagnostic tool. Execution is conditionally gated by environment variables to evade detection. No integrity checks are performed on the downloaded payload, increasing risk of arbitrary code execution.