The npm package bigops-products-investment version 35.3.1 contains malicious code that downloads and executes platform-specific binaries from Cloudflare Workers hosts or via covert DNS TXT record retrieval. The binaries are saved under disguised filenames and executed without integrity verification. The package includes telemetry-related code that is not actually used for telemetry but to gate the malicious behavior. This is a supply chain threat involving remote code execution through a malicious package.