The npm package devplatform-api-v1-resources version 35.4.7 contains malicious code that downloads and executes platform-specific binaries from obfuscated Cloudflare Workers domains and a Russian DNS fallback. The binaries are saved in temporary directories with disguised names, given executable permissions, and run without any integrity verification. This behavior is also replicated in a telemetry SDK component within the package. The command-and-control hostnames are dynamically assembled at runtime to evade static detection.