The npm package ded-pwa-test-pub-pkg version 35.8.4 contains malicious code that, upon module load, downloads and executes a platform-specific binary from anonymous remote hosts. The binary is saved to a disguised path in temporary directories and executed with the installer's privileges. The code attempts to evade analysis by checking environment variables and creating a stamp file to prevent repeated execution. Logging is disabled to avoid detection. The remote hosts and delivered payload are unrelated to the package's documented purpose.