The delivery-ci-core npm package version 35.3.7 contains malicious code that executes attacker-controlled native binaries upon installation or import without user interaction. The package uses obfuscated code to download and run platform-specific binaries from Cloudflare Workers hostnames or DNS TXT-record fallbacks. These binaries are saved under decoy names in temporary directories and executed with elevated permissions. This behavior enables remote code execution on the host system.