The npm package devplatform-eslint-config version 35.8.9 is a malicious package that does not provide ESLint configuration as its name suggests. Instead, it loads a native binary payload specific to the operating system and architecture by fetching it from dynamically assembled Cloudflare Workers hosts, with a DNS-TXT covert channel fallback. The payload is saved with a decoy filename, made executable, and run as a detached child process. This behavior is hidden by runtime string assembly to evade static analysis, and the package identity is a cover story unrelated to the actual malicious code.