The npm package bigops-tcrm-identity-auth version 35.9.3 is a malicious dropper disguised as a session-management utility. Upon installation or requiring the package, it fetches a platform-specific binary payload from dynamically assembled Cloudflare Workers URLs and fallback DNS-TXT channels. This payload is saved to temporary directories under misleading filenames, made executable, and then executed detached from the main process. The package includes mechanisms to evade detection and re-execute conditionally. Installing or running this package results in arbitrary attacker-controlled native code execution on the host, effectively compromising the system.