This threat involves a malicious npm package (bigops-plugin-notification-builder, version 35.1.3) that executes unauthorized code on the host system. The package's index.js loads a _bridge.js script that downloads a platform-specific binary from hardcoded, obfuscated Cloudflare Workers domains. If HTTPS retrieval fails, the binary is reassembled from DNS TXT records hosted on suspicious domains. The binary is saved to disguised temporary executable files and launched detached via shell commands without any integrity checks. The code uses string splitting and array joining to hide sensitive API calls and hostnames, complicating static analysis. A parallel malicious dropper exists in lib/telemetry.js, masquerading as an analytics SDK. No patch or remediation information is provided.

If executed, this malicious package can run arbitrary code on the host system, potentially leading to full system compromise, unauthorized data access, or further malware deployment. The lack of signature or hash verification means the payload could be tampered with or replaced by attackers. The obfuscation and use of multiple delivery methods increase the difficulty of detection and analysis. This poses a significant risk to any environment that installs or uses this specific package version.

No official patch or remediation is currently documented for this malicious package version. The best mitigation is to avoid using bigops-plugin-notification-builder version 35.1.3 entirely. Users should remove this package from their environments and replace it with trusted alternatives. Monitor dependency sources carefully and verify package integrity before installation. Since this is a malicious package, no vendor advisory or official fix is available; users must rely on removal and avoidance.