The npm package ded-pwa-c-page-maker-props version 35.7.7 contains malicious code that, upon import, fetches and executes an unsigned attacker-controlled binary on the user's machine. It uses obfuscated Cloudflare Workers endpoints to download a binary payload, which it writes to temporary directories and executes detached. If the HTTPS fetch fails, it falls back to a covert DNS-TXT channel to retrieve the payload. The package falsely advertises itself as a PWA props module but provides no legitimate functionality beyond this malicious behavior.