The npm package 'bigops-products-mobile' version 35.6.8 contains malicious code that performs remote code execution on the host system upon installation and import. It downloads attacker-controlled binaries from obfuscated Cloudflare Workers domains and a DNS-TXT fallback, writes them to disguised file paths, sets executable permissions, and executes them without any integrity verification. The package masquerades as a device integration tool but includes hidden persistence mechanisms and telemetry-like comments to evade detection.