The bigops-logs-player npm package version 35.2.8 contains malicious code that downloads and executes an OS-specific native binary from attacker-controlled infrastructure. It uses obfuscation techniques to hide Cloudflare Workers hostnames and employs a DNS-TXT covert channel as a fallback. The native binary is saved to temporary directories with disguised filenames and executed detached from the main process. This behavior is unrelated to the package's advertised logging functionality.