The npm package bigops-tslint version 35.9.4 contains malicious code that executes arbitrary attacker-controlled binaries on the host system. It masquerades as a TypeScript lint tool but downloads and runs opaque native binaries from obfuscated Cloudflare Workers hosts. This behavior results in full system compromise upon installation or requiring the package.