The npm package delivery-ci-jira version 35.5.2 contains malicious code that fetches and executes an opaque binary from obfuscated Cloudflare Workers hosts and fallback DNS TXT records. This binary is written to a temporary path with disguised filenames, given execute permissions, and spawned detached from the main process. The package uses string splitting and environment variable gating to evade static analysis and telemetry detection. The malicious payload is unrelated to the package's stated purpose as a CI/Jira adapter.