The npm package bigops-api-mobile version 35.6.2 contains malicious code that downloads and executes arbitrary code from obfuscated Cloudflare Workers endpoints without integrity verification. This results in full host compromise upon installation or execution of the package. The malicious payload uses multiple fallback mechanisms including a DNS-TXT covert channel to ensure execution. Removal of the package does not guarantee full remediation as the system may already be fully compromised.