The npm package bigops-products-loans version 35.6.4 contains malicious code that downloads and executes platform-specific binaries from obfuscated Cloudflare Workers subdomains and DNS TXT record fallbacks. The binaries are saved to temporary directories with disguised names, given executable permissions, and executed detached from the main process. A secondary dropper disguised as an analytics SDK is also included but not currently active via the main require path. This behavior enables stealthy execution of potentially harmful payloads on affected systems.