The npm package bigops-products-insurance version 35.3.4 contains malicious code that, when installed or imported, downloads and executes an attacker-controlled binary on the victim's machine. The binary is fetched from obfuscated remote hosts and written to temporary directories under disguised filenames before execution. This behavior allows arbitrary code execution on the installer's system.