The npm package 'bi-core-bi-core-core' version 35.8.5 is a malicious typosquatting package that downloads and executes external binaries from Cloudflare Workers and fallback domains. It disguises its payload by dynamically constructing URLs and filenames, writes executables to temporary directories, sets executable permissions, and runs them detached on both Unix and Windows systems. The package itself contains no legitimate functionality and acts as a dropper for malicious code. Any system with this package installed or running should be considered fully compromised.