The npm package 'bigops-products-bnpl' version 35.2.9 contains malicious code that, when required, downloads and executes arbitrary binaries from attacker-controlled Cloudflare Workers endpoints. This behavior results in arbitrary code execution on the machine loading the package, bypassing any integrity checks and disguising the payload as telemetry or analytics. No official patch or remediation guidance is provided.