The bigops-nitro-client package (version 35.6.1) includes code that, upon require(), loads a script (_vendor.js) which downloads a native binary tailored to the platform from several rotating Cloudflare Workers endpoints and fallback DNS-TXT base64 encoded channels hosted on wel1.ru domains. The binary is saved to temporary directories with disguised names such as dotnet_diag or .cache, given executable permissions, and executed detached via shell commands. Hostnames used for downloading are constructed dynamically at runtime to evade static detection. The package falsely presents itself as a simple stub client, with no legitimate need for native binary downloads or execution, confirming its malicious nature.

The malicious package can execute arbitrary native code on the host system by downloading and running binaries without user consent or legitimate purpose. This behavior can lead to unauthorized code execution, potential system compromise, persistence, and further malicious activities depending on the payload delivered by the native binary.

No official patch or remediation is currently documented. Users should avoid using bigops-nitro-client version 35.6.1. Remove the package from any environments where it is installed. Monitor for and block network connections to the identified Cloudflare Workers endpoints and fallback domains if possible. Check for and remove any binaries downloaded to temporary directories with suspicious names. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.