The npm package bigops-shared-product-design version 35.9.3 contains malicious code that unconditionally loads a module which downloads and executes a platform-specific native binary from suspicious Cloudflare Workers hosts and fallback DNS-TXT resolver domains. The downloaded payload is saved to temporary directories with masqueraded filenames, given executable permissions, and executed detached from the parent process. This behavior is indicative of a dropper toolkit designed to evade static analysis and persist on the system.