The bigops-outgoing-call npm package version 35.1.6 contains malicious code that, upon requiring its main module, downloads and executes an opaque binary payload from multiple Cloudflare Workers hosts without verification. The payload is stored in temporary directories under disguised filenames and executed detached from the main process. Additionally, the package includes an undeclared telemetry.js file that is not referenced or listed in package metadata. This behavior is unrelated to the package's advertised functionality and indicates malicious intent.