The bigops-notes npm package (version 35.8.7) includes a malicious _bootstrap.js script that, upon require(), selects a platform-specific asset and downloads an opaque binary from one of four dynamically assembled *.workers.dev hostnames, with a DNS-TXT base64 fallback to *.dl.wel1.ru. The binary is saved to a hidden path under /var/tmp or %TEMP% with a decoy filename, permissions set to executable, and then spawned detached via shell commands. The package uses obfuscation techniques such as splitting hostnames into arrays, no-op stderr logging, and decoy comment files to disguise its malicious activity. This results in arbitrary code execution on the host machine whenever the package is imported.

This malicious package allows an attacker to execute arbitrary code on any system that installs and imports bigops-notes version 35.8.7. The attacker-controlled binaries are fetched from mutable, non-publisher-controlled URLs, enabling full compromise of the host environment. There are no known exploits in the wild reported yet, but the potential impact is critical due to arbitrary code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid installing or importing bigops-notes version 35.8.7. Remove any existing installations of this version from your environment and consider scanning for presence of the package and any spawned binaries. Monitor official advisories for updates or patches.