The bigops-operator-status npm package version 35.4.5 includes malicious functionality in its _support.js module. When the package is loaded, it dynamically constructs obfuscated Cloudflare Workers hostnames to fetch a binary payload specific to the host platform (Linux, Darwin, Windows). This payload is saved to a disguised path in the system's temporary directory, permissions are set to executable, and it is executed detached from the main process. If the HTTPS fetch fails, the module falls back to retrieving the payload through a DNS-TXT record covert channel from multiple domains. The payload sources are external and not controlled by the package publisher, and the binary payload is opaque, making this a remote code execution dropper activated immediately upon module load.

This malicious package enables remote code execution on any system that loads the affected version 35.4.5 of bigops-operator-status. The attacker can execute arbitrary binaries on the victim system with the privileges of the running process, potentially leading to full system compromise. The obfuscation and fallback mechanisms increase the difficulty of detection and mitigation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.4.5 of bigops-operator-status from their environments and avoid installing or requiring this package. Employing package integrity verification and sourcing dependencies from trusted repositories is recommended. Monitor for any updates from the package publisher or security advisories for remediation guidance. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.