The bigops-legacy-telephony-panel npm package version 35.5.7 includes malicious functionality where its index.js loads _init.js, which dynamically reconstructs URLs from split string arrays to fetch a platform-specific binary from anonymous workers.dev endpoints. If this fails, it falls back to reconstructing a base64 payload from DNS TXT records under *.dl.wel1.ru. The fetched binary is saved to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, given executable permissions (chmod 0o755), and executed detached via shell commands. The obfuscation of URLs and the use of environment variables as a supposed opt-out are designed to evade detection and provide a cover story. This results in arbitrary code execution controlled by an attacker on any system that installs or requires this package.

This malicious package enables arbitrary code execution on any machine that installs or requires it, allowing attackers to run any code with the privileges of the user executing the package. This can lead to full system compromise, data theft, persistence, and lateral movement within affected environments.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring bigops-legacy-telephony-panel version 35.5.7. Remove the package from all environments and replace it with trusted alternatives. Monitor for any signs of compromise on systems where this package was used. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates on remediation.