The npm package delivery-ci-codeceptjs-fork version 35.4.5 contains malicious code that executes remote code at install/load time. It reconstructs attacker-controlled hostnames to download platform-specific binaries, which are saved to temporary directories with disguised names, given executable permissions, and executed detached from the main process. A covert DNS-TXT channel is used as a fallback to retrieve payload data. The package also includes a second dropper component disguised as an analytics SDK with similar malicious behavior. This establishes remote code execution on any system that imports this package version.