The npm package bigops-tinkoff-telephony-mock version 35.5.1 contains malicious code that downloads and executes a platform-specific binary from external Cloudflare Workers hosts without verification. This binary is disguised as .NET diagnostics files and executed on the host system, enabling remote code execution. The package also includes a fake telemetry SDK that bundles the same dropper. Any system installing or importing this package is fully compromised, risking exposure of all stored secrets and keys.