The devplatform-spa-plugin-remote-module npm package version 35.9.6 contains malicious code that downloads and executes a platform-specific binary from obfuscated external hosts. The binary is saved to temporary directories with disguised names, given executable permissions, and launched detached from the main process. The code uses runtime string reconstruction to evade static analysis. A secondary module includes similar dropper functionality bundled as a payload.