The bigops-tasks-client npm package version 35.1.2 contains malicious code that, upon import, downloads and executes a platform-specific binary from obfuscated Cloudflare Workers endpoints. This binary is saved to temporary directories with filenames mimicking legitimate tools and executed detached from the main process. The package's advertised functionality is unrelated to this behavior, indicating deliberate malicious intent. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removal of the package alone may not eliminate the compromise due to potential persistence mechanisms.