The npm package bigops-activity-headers-interceptor version 35.6.8 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers domains. This binary is saved under decoy names in temporary directories and executed detached from the main process. The malware enforces a roughly 6-hour execution interval and respects certain environment variables to disable telemetry. The package's behavior is unrelated to its stated purpose and indicates a full system compromise risk.