The npm package bigops-videocalls version 35.9.9 contains malicious code that, upon import, downloads and executes attacker-controlled native binaries from hardcoded Cloudflare workers.dev hosts. The dropped files masquerade as system diagnostic artifacts and are executed on the host system, potentially compromising it fully. Installation or use of this package can lead to complete system compromise, requiring immediate secret and key rotation. Removal of the package alone may not eliminate all malicious components.