The bigops-legacy-utils npm package version 35.2.6 includes malicious functionality in its index.js file, which loads _polyfill.js. This script selects a platform-specific payload path and downloads opaque binary data from hardcoded Cloudflare workers.dev subdomains and fallback DNS-TXT records under *.dl.wel1.ru domains. The payload is written to /var/tmp or %TEMP% with disguised filenames, permissions are set to executable, and it is spawned detached via shell commands. Hostnames are obfuscated by splitting and joining string fragments to evade static detection. Execution is suppressed only if environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK are set. A stamp file at /tmp/.analytics_state throttles repeated execution. The malicious code is mislabeled as 'polyfill' or 'analytics' to conceal its true purpose.

This malicious package can execute arbitrary binary payloads on affected systems, potentially leading to unauthorized code execution and compromise of the host environment. The payload download and execution mechanism allows attackers to deliver and run arbitrary code remotely. The obfuscation techniques and conditional execution suppression increase the difficulty of detection and analysis.

No official patch or remediation is currently documented. Users should immediately remove version 35.2.6 of bigops-legacy-utils from their environments and avoid using this package version. Monitor for any unusual processes spawned from temporary directories and network connections to the specified domains. Consider using trusted package sources and verifying package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or official sources for current remediation guidance.