The bigops-abstract-entity-data npm package version 35.1.7 includes a malicious module that, when loaded, unconditionally requires a loader script. This loader dynamically reconstructs hostnames to download binary payloads from multiple anonymous Cloudflare Workers domains and a DNS-TXT fallback resolver. The payload is saved to temporary directories under decoy filenames, made executable, and executed detached via shell commands. No integrity checks such as hashing or signature verification are performed on the downloaded binaries, enabling arbitrary attacker-controlled code execution on any machine that requires this package.

Any system that installs and requires bigops-abstract-entity-data version 35.1.7 will execute arbitrary code controlled by an attacker. This can lead to full compromise of the affected host, including unauthorized access, data theft, persistence, and further malicious activities. The execution is detached and stealthy, increasing the risk of unnoticed compromise.

No official patch or fix is currently available for this malicious package version. Users should immediately remove bigops-abstract-entity-data version 35.1.7 from their dependencies and avoid requiring it in any environment. Verify all npm packages for authenticity and integrity before use, and consider using trusted package registries and supply chain security tools to detect and block malicious packages.