The bigops-products npm package version 35.7.4 contains malicious code that downloads and executes a platform-specific binary from dynamically constructed Cloudflare Workers hosts. It uses a DNS-TXT covert channel fallback to reconstruct a base64 payload from subdomains of dl.wel1.ru. The binary is saved to temporary directories with obfuscated filenames, given executable permissions, and executed detached from the main process. Telemetry evasion is implemented via marker files and environment variables. This behavior indicates a supply chain compromise with potential unauthorized code execution.