The npm package 'bigops-tasks' version 35.1.4 contains malicious code that, upon requiring the package, downloads and executes a platform-specific native binary from obfuscated Cloudflare Workers hosts and fallback domains. The binary is saved to temporary directories, given execute permissions, and run without any proper integrity verification despite misleading comments. This behavior is disguised as analytics or telemetry. Systems with this package installed should be considered fully compromised, and all secrets and keys on affected machines should be rotated immediately. Removal of the package does not guarantee full remediation due to potential persistent malicious software.