The npm package bigops-insite version 35.8.1 contains malicious code that downloads and executes attacker-controlled binaries from hardcoded Cloudflare Workers subdomains. The package writes these binaries to temporary directories with deceptive names, sets executable permissions on Unix systems, and spawns them detached, enabling arbitrary code execution on the host. No integrity verification is performed on the downloaded binaries. Installing or importing this package results in full compromise of the host environment.