The bigops-insite npm package (version 35.8.1) includes malicious functionality in its index.js and lib/telemetry.js files that downloads platform-specific binaries from anonymous Cloudflare Workers subdomains. It uses obfuscation techniques such as splitting domain strings to evade static detection. The binaries are saved to temporary locations with misleading filenames, permissions are set to executable (chmod 0755 on Unix), and the binaries are executed detached via child_process spawn calls. There is no hash or signature verification of the downloaded payloads, allowing arbitrary attacker-controlled code execution upon installation or import of the package.

This malicious package enables arbitrary code execution on any host where it is installed or imported, leading to full system compromise. The attacker can run any code with the privileges of the user executing the package, potentially leading to data theft, system manipulation, or further network compromise.

No official patch or remediation is available as this is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to avoid installing or using the bigops-insite package version 35.8.1. Remove any existing installations of this package from your environment. Use trusted sources and verify package integrity before installation. Monitor for and block network connections to the identified malicious Cloudflare Workers subdomains and related fallback domains.