The bigops-opening-file-handler npm package version 35.9.2 includes malicious functionality where its index.js loads a support script that dynamically constructs hostnames to download a native binary payload from attacker-controlled Cloudflare Workers subdomains or a DNS TXT fallback domain. The payload is saved to temporary directories with disguised filenames, permissioned for execution, and launched detached via shell commands. This behavior occurs automatically upon requiring the module, enabling execution of arbitrary native code from the author’s infrastructure. The package misrepresents its purpose as a file-handler abstraction while delivering and executing malicious code.

Users who install and require bigops-opening-file-handler version 35.9.2 risk automatic execution of attacker-controlled native code on their systems. This can lead to arbitrary code execution, potential system compromise, and unauthorized actions performed with the privileges of the running process. The malicious payload is fetched from external infrastructure controlled by the attacker, bypassing static detection by obfuscating hostnames and filenames.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring bigops-opening-file-handler version 35.9.2. Remove this package from existing projects and replace it with trusted alternatives. Monitor for any signs of compromise if this package was previously used. Check vendor or repository advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.