The npm package bigops-watchdog-worker version 35.7.4 contains malicious code that downloads and executes a remote binary payload on affected systems. This payload is fetched from non-publisher-controlled domains and executed with elevated permissions, masquerading as a Microsoft diagnostic tool. The malware includes anti-analysis features to evade detection and can fully compromise the host system. Removal of the package does not guarantee eradication of the malware, and all secrets on the system should be considered compromised and rotated immediately.