The npm package 'devplatform-stylelint-config' version 35.7.4 contains malicious code that executes upon library load. It downloads a platform-specific binary from obfuscated Cloudflare Workers and other domains, writes it to a hidden temporary location, sets executable permissions, and runs it detached without verifying its integrity. The package uses misleading naming and description to conceal its true behavior.