The bigops-alerts-widget npm package (version 35.8.3) includes malicious code that triggers on require() calls. It dynamically selects a payload based on the host platform and architecture, then downloads an opaque binary from obfuscated Cloudflare Workers URLs. The binary is saved to temporary directories under disguised filenames, permissioned to execute, and spawned detached via shell commands. If the primary download fails, a fallback mechanism uses multiple DNS TXT queries to covertly retrieve a base64-encoded executable, which is then run similarly. This import-time execution of attacker-controlled binaries enables remote code execution on the host machine, effectively compromising the system.

Systems with the affected package installed are fully compromised, allowing attackers to execute arbitrary code remotely. This compromises confidentiality, integrity, and availability of the host. All stored secrets and keys on the compromised system are at risk and should be rotated immediately from a secure environment. Removal of the package alone may not remove all malicious artifacts, indicating potential persistence mechanisms.

Immediate removal of the bigops-alerts-widget package version 35.8.3 is recommended. All secrets and keys stored on the compromised system should be rotated from a different, secure computer. Due to the high risk of full system compromise and potential persistence, a full incident response and system rebuild may be necessary. Patch status is not applicable as this is a malicious package rather than a vulnerability with an official fix.