The bigops-jsonpath-mapper package (version 35.4.6) includes code in index.js that loads _bridge.js, which constructs obfuscated hostnames to fetch a native binary over HTTPS from attacker-controlled domains. The binary is saved to temporary directories with disguised names and appropriate execution permissions, then spawned detached and unreferenced via shell commands. A TTL file prevents repeated execution across imports. Despite comments suggesting telemetry functionality, the actual behavior is a fetch-and-execute dropper that runs opaque code from non-publisher infrastructure at module load time.

This malicious behavior allows arbitrary code execution on the host system when the package is imported, potentially leading to full system compromise, data theft, or further malware deployment. The execution of attacker-controlled native binaries bypasses typical JavaScript sandboxing and can evade detection due to obfuscation and use of temporary disguised files.

No official patch or remediation is currently documented. Users should immediately remove and avoid using version 35.4.6 of bigops-jsonpath-mapper. Verify the integrity of dependencies and consider replacing this package with a trusted alternative. Monitor for suspicious activity related to this package and clean affected systems. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.