The bigops-nitro-client npm package version 35.6.1 contains malicious code that downloads and executes a platform-specific native binary from multiple rotating Cloudflare Workers endpoints and fallback DNS-TXT base64 channels. The binary is saved under disguised filenames in temporary directories and executed detached from the main process. The package masquerades as a trivial client but has no legitimate reason to download or run native binaries, indicating malicious intent.