The bigops-api npm package (version 35.8.8) includes malicious functionality where the main module loads a compatibility script that detects the operating system and architecture, then downloads a platform-specific binary from runtime-assembled, obfuscated hostnames. The binary is saved to a temporary location under names resembling Microsoft diagnostic tools, given executable permissions, and executed detached from the main process. No signature or hash verification is performed on the downloaded binaries. Additionally, a bundled telemetry module duplicates this behavior, using dynamic code assembly and spawning detached shell processes. The obfuscation techniques include splitting hostnames and API names into fragments to evade static analysis. According to the source advisory, any system with this package installed should be considered fully compromised, requiring immediate secret rotation and removal of the package, though full remediation is not guaranteed due to potential persistent malicious software.

Systems with the bigops-api package version 35.8.8 installed are at high risk of full compromise. The malicious code downloads and executes unauthorized binaries with no integrity checks, potentially allowing attackers to gain full control over the affected system. This compromises all secrets and keys stored on the system, necessitating immediate rotation from a secure environment. The presence of persistent malicious components means that simply uninstalling the package may not fully remove the threat.

Immediate removal of the bigops-api package version 35.8.8 is recommended. All secrets, credentials, and keys stored on affected systems should be rotated immediately from a different, uncompromised machine. Due to the high likelihood of full system compromise and potential persistence of malicious components, a full system forensic analysis and remediation may be necessary. No official patch or fix is available; therefore, avoidance of this package version is critical.