The bigops-outgoing-call npm package version 35.1.6 loads a runtime script that dynamically selects a platform-specific asset path and fetches a binary payload from one of four Cloudflare Workers hosts assembled via string manipulation. If that fails, it uses a DNS TXT record covert channel to reconstruct a base64-encoded payload from records under the domain wel1.ru. The fetched binary is saved to temporary directories with disguised names, permissions set to executable, and then spawned detached using shell commands. No integrity checks such as hash or signature verification are performed. The package also contains an undeclared telemetry.js file (~80 KB) that is not executed or referenced in the module graph or package.json, suggesting hidden or unused code. The destination hosts and payload behavior are unrelated to the package's stated purpose as an outgoing call wrapper, indicating malicious code execution.

This malicious package can execute arbitrary binary code on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The use of multiple delivery methods including Cloudflare Workers and DNS TXT record covert channels complicates detection and blocking. The execution of opaque binaries with no integrity verification increases risk of persistent malware or backdoors. The presence of undeclared code further suggests hidden malicious functionality.

Users should immediately remove version 35.1.6 of the bigops-outgoing-call package from their environments. Avoid using this package version and verify dependencies for similar malicious behavior. Since no official patch or remediation is indicated, rely on package removal and replacement with trusted alternatives. Monitor for any binaries or files matching the described naming patterns in temporary directories and remove them. No vendor advisory or official fix is currently available; patch status is not yet confirmed — check the vendor advisory for current remediation guidance.