The bigops-activity-headers-interceptor npm package (version 35.6.8) includes malicious functionality where requiring the package triggers an automatic start function. This function downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains and a DNS-TXT fallback channel. The binary is saved to temporary directories with decoy filenames, permissioned to be executable, and launched detached from the main process. A lock file mechanism limits execution frequency to about once every six hours. The malware respects environment variables that disable telemetry or tracking. The downloaded binary is opaque and unrelated to the package's declared functionality, indicating a supply chain compromise and full system compromise risk for any machine running this package.

Any system with this package installed or running should be considered fully compromised. The attacker likely gains full control over the affected computer. All secrets and keys stored on the system are at risk and should be rotated immediately from a separate, trusted machine. Removing the package alone may not fully remove the malicious software or backdoors installed by the attacker.

Immediate removal of the bigops-activity-headers-interceptor package version 35.6.8 is recommended. All credentials and secrets stored on the affected system should be rotated from a different, secure machine. Due to the potential for full system compromise, a full forensic investigation and system rebuild may be necessary. There is no official patch or fix available; remediation relies on removal and credential rotation.