The delivery-ci-cli npm package version 35.3.5 contains malicious code that downloads and executes platform-specific native binaries from obfuscated Cloudflare Workers hosts without verification. If HTTPS delivery fails, it uses a DNS-TXT record covert channel to retrieve and execute payloads. The package masquerades as a benign CI CLI SDK with no dependencies to conceal its dropper behavior.