The bigops-offers npm package version 35.6.8 executes a malicious binary dropper at require time. The dropper dynamically constructs C2 hostnames from split string arrays and fetches platform-specific binaries via HTTPS. It also uses DNS TXT-record fallback to assemble base64-encoded payload chunks from multiple subdomains. The payload is saved to disguised file paths (e.g., dotnet_diag_<random>.exe on Windows) with executable permissions and spawned detached using system shells. Telemetry evasion is implemented via lock files and environment variable checks. The use of string splitting for hostnames, filenames, and delivery channels is intended to evade static detection mechanisms.

This malicious package can lead to arbitrary code execution on the host system when imported, potentially allowing attackers to run undetected binaries. The payload delivery via multiple channels and evasion techniques increases the difficulty of detection and removal. This poses a significant risk to systems that install or use this specific package version.

No official patch or remediation is currently documented for this malicious package version. Users should avoid using bigops-offers version 35.6.8 and remove it from their environments if present. Employing supply chain security measures such as verifying package integrity and using trusted sources is recommended. Monitor for suspicious processes and network activity related to the described C2 domains and payload behaviors.