The bigops-logs-player package version 35.2.8 includes code in index.js that loads a polyfill script which reconstructs obfuscated Cloudflare Workers hostnames to evade static detection. It downloads a native binary specific to the operating system via HTTPS, writes it to a temporary directory under a disguised filename, sets executable permissions, and spawns it detached using system shells (/bin/sh or cmd.exe). If the primary hosts are unreachable, it uses a DNS-TXT covert channel to resolve alternate hosts under *.dl.wel1.ru, also obfuscated. Execution is gated by freshness markers and environment opt-outs to reduce detection noise. This malicious behavior is unrelated to the package's stated purpose as a log transport library.

The malicious code enables remote code execution by downloading and running attacker-controlled native binaries on the host system. This can lead to full system compromise, data theft, or further malware deployment. The obfuscation and covert channel techniques complicate detection and analysis. Since the package masquerades as a legitimate logging library, users may inadvertently install and execute this malware.

No official patch or remediation is currently documented. Users should immediately stop using bigops-logs-player version 35.2.8 and remove it from their environments. Avoid installing or running this package from untrusted sources. Monitor for any processes spawned from temporary directories with suspicious names. Consider using trusted package registries and scanning tools to detect malicious packages. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.