The bigops-microfrontend npm package version 35.4.1 includes malicious code that triggers on any require() call. The index.js file requires a _shim.js module that reconstructs obfuscated C2 hostnames and selects platform-specific endpoints to download a native binary payload. This payload is fetched over HTTPS with a DNS-TXT fallback mechanism, assembled from base64 chunks, saved to temporary directories with disguised names, permissioned to be executable, and then spawned detached via shell commands. This behavior results in full arbitrary code execution on the host machine. Additionally, lib/telemetry.js contains a similar dropper mechanism framed as an analytics SDK but is not automatically executed. The Windows payload impersonates a .NET diagnostic tool to evade detection. No official patch or remediation information is provided.

This malicious package enables attackers to execute arbitrary native code on any system that installs and requires bigops-microfrontend version 35.4.1. This can lead to full system compromise, persistence, and potential further malicious activity. The attack uses obfuscated C2 infrastructure and stealthy payload delivery, increasing the risk of undetected compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid using or installing bigops-microfrontend version 35.4.1. Conduct thorough audits of dependencies and consider removing or replacing this package. Monitor for any vendor updates or security advisories regarding this package.