The npm package ded-pwa-c-mapping version 35.8.7 contains malicious code that, upon requiring the package, executes a bootstrap routine to download and run a native binary payload from dynamically assembled, obfuscated external hosts. The payload is saved under disguised filenames in temporary directories, given executable permissions, and launched detached from the installing process without any integrity verification. The code attempts to evade detection by assembling hostnames at runtime and referencing environment variables to frame the behavior as telemetry. No official patch or remediation guidance is provided.