The npm package bigops-legacy-utils version 35.2.6 contains malicious code that, when required, downloads and executes a platform-specific binary payload from hardcoded external domains. The payload is saved to temporary directories under disguised filenames and executed detached from the main process. The code attempts to evade detection by reconstructing hostnames from string fragments and suppresses execution if certain environment variables indicating telemetry opt-out are set. This behavior is disguised as 'polyfill' or 'analytics' functionality.