The bigops-product-list npm package version 35.8.5 includes malicious code in its index.js and lib/telemetry.js files. On module load, setup.js is required unconditionally and dynamically constructs destination hostnames from fragmented strings to evade static scanners. It selects platform-specific endpoints on suspicious domains (*.workers.dev and *.dl.wel1.ru) to download an opaque binary over HTTPS, with a DNS-TXT base64 chunked fallback. The binary is saved to temporary directories under disguised names, permissions are set to executable, and it is spawned detached via shell commands. The package includes environment checks and filesystem markers to avoid execution in analyst environments. The malicious behavior is unrelated to the package's stated function as a product-list library.

This malicious package can lead to unauthorized code execution on systems that install and run version 35.8.5 of bigops-product-list. The downloaded binaries could perform any number of malicious actions, including data theft, persistence, or further malware deployment. The obfuscation and anti-analysis techniques increase the risk of undetected compromise.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.8.5 of bigops-product-list from their environments and avoid installing it. Verify package integrity and source before installation. Consider using trusted package registries and tools that detect malicious npm packages. Monitor for any unexpected network connections or spawned processes related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.