The bigops-procedure-file-handlers npm package version 35.7.6 includes malicious runtime behavior where upon requiring the package, a script downloads a platform-specific executable from obfuscated Cloudflare Workers endpoints. The executable is saved to temporary directories with filenames mimicking legitimate telemetry files and is executed detached from the main process. If the HTTPS download fails, the package falls back to retrieving base64-encoded code chunks from DNS TXT records under the dl.wel1.ru domain, reassembles them, and executes the resulting code buffer. The use of obfuscated endpoints, covert DNS-based code delivery, and disguised filenames strongly indicate malicious intent rather than legitimate telemetry or binary distribution.

This malicious package can execute arbitrary code on the host system by downloading and running executables or code buffers from attacker-controlled infrastructure. This can lead to full system compromise or unauthorized actions under the context of the executing process. The evasion techniques used (obfuscation, covert DNS channel, disguised filenames) make detection and mitigation more difficult.

No official patch or remediation is currently available for this malicious package version. Users should avoid using bigops-procedure-file-handlers version 35.7.6 and remove it from their environments if present. Monitor for and block network connections to the described Cloudflare Workers endpoints and the dl.wel1.ru DNS domain. Employ runtime protection to detect suspicious process spawning from temporary directories with disguised telemetry-like filenames. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.