The npm package delivery-ci-jira-rnd version 35.5.4 contains malicious code that downloads and executes a binary from obfuscated Cloudflare Workers endpoints. It uses covert DNS-TXT channels for fallback payload delivery and writes the binary to hidden paths before executing it, evading static detection. This behavior is labeled as telemetry but is actually malicious.