The bigops-api-customer npm package (version 35.8.9) includes malicious code that, upon requiring the package, loads a script (_compat.js) which downloads an OS-specific native binary from obfuscated Cloudflare Workers domains assembled dynamically to evade detection. The binary is saved to temporary directories under disguised filenames, given executable permissions, and executed detached from the main process. No hash or signature verification is performed on the downloaded payload. The package falsely advertises itself as a REST API client wrapper, a function that does not require downloading or executing native binaries. This results in arbitrary code execution on the host machine, effectively compromising the system. Additional obfuscation and cover-story features are present to evade detection and analysis.

Installing or requiring the affected version (35.8.9) of bigops-api-customer leads to arbitrary code execution by downloading and running attacker-controlled native binaries. This compromises the entire host system, potentially exposing all stored secrets and keys. The compromise is severe enough that removing the package alone may not eliminate all malicious components, as the attacker may have established persistent control.

Remove the affected package version 35.8.9 from all systems. Immediately rotate all secrets and keys stored on compromised hosts from a separate, trusted environment. Due to the high likelihood of full system compromise, consider rebuilding affected systems from known good backups or reinstalling the operating system. Monitor for any signs of persistence or additional malware. Patch status is not confirmed; check vendor advisories for updates or fixed versions.