The npm package beaver-ui-popover-marker version 35.5.8 contains malicious code that executes upon requiring the package. It downloads and runs a platform-specific binary from obfuscated Cloudflare Workers hosts, writing it as a hidden file in temporary directories and executing it detached from the main process. The package masquerades as a React UI component but performs unauthorized native code execution, posing a severe risk to any system that installs or requires it.