The bigops-jsonpath-mapper npm package version 35.4.6 contains malicious code that, upon module load, downloads and executes a platform-specific native binary from attacker-controlled infrastructure. The binary is saved under disguised filenames in temporary directories and executed detached from the parent process. This behavior is disguised as telemetry or session tracking but functions as a fetch-and-execute dropper, enabling arbitrary code execution on the host system.