The npm package bigops-abstract-entity-data version 35.1.7 contains malicious code that downloads and executes arbitrary attacker-controlled binaries on the host machine. Upon requiring the package, it fetches platform-specific payloads from rotating Cloudflare Workers hosts and a DNS-TXT fallback, writes them to temporary files with decoy names, sets executable permissions, and runs them detached. This behavior results in arbitrary code execution without verification of the downloaded content.