The npm package bigops-products-timeline-commons version 35.1.6 contains malicious code that executes at import time. It loads a hidden loader script that downloads and executes a platform-specific binary from obfuscated remote hosts without verification. The binary is saved under disguised filenames and executed detached, enabling remote code execution upon package import.