The delivery-ci-dpat npm package version 35.1.5 contains malicious code that, upon requiring the module, downloads and executes a platform-specific binary from hardcoded Cloudflare Workers hosts. It also uses a covert DNS-TXT channel as a fallback to fetch and execute a payload. The malicious behavior is disguised as analytics or telemetry and includes run-once deduplication using a filesystem stamp.