The npm package delivery-ci-codeceptjs version 35.1.7 contains malicious code that downloads and executes opaque native binaries from obfuscated Cloudflare Workers subdomains and DNS-TXT record fallbacks. The package's main entry triggers a setup routine that fetches these binaries, writes them to hidden temporary files, sets executable permissions, and runs them detached from the main process. The package itself advertises a trivial no-op class and lacks native source code consistent with the downloaded payload. The obfuscation techniques and fallback mechanisms are designed to evade static detection and blend with normal system activity.