The npm package devplatform-spa-plugin-feature-toggle version 35.7.4 contains malicious code that executes attacker-controlled binaries on the host system during module import. It downloads OS-specific executables from suspicious Cloudflare Workers and a dynamic DNS domain, writes them to temporary directories, sets executable permissions, and runs them detached. The package disguises this behavior under misleading names like "analytics_state" and "telemetry" which do not align with its advertised functionality. No integrity checks or pinning are performed on the downloaded payloads.