The npm package bigops-tcrm-auth version 35.8.5 contains malicious code that downloads and executes a native binary from obfuscated and suspicious hosts. It disguises its payload delivery using runtime hostname assembly, DNS TXT record fallback, and file name obfuscation. The package masquerades as an authentication module but performs unauthorized code execution, posing a severe risk to any system where it is installed.