The npm package bigops-nitro-events-table version 35.4.2 contains malicious code that downloads and executes a platform-specific binary payload from suspicious Cloudflare Workers hostnames and fallback DNS-TXT records. The payload is saved to temporary directories, given executable permissions, and launched detached from the main process. The package masquerades as a simple pub/sub adapter but performs unauthorized remote code execution. It attempts to evade detection by spoofing user agents and respecting certain environment variables to avoid execution on privacy-conscious hosts.