This threat involves a malicious npm package 'bigops-products-accounts-and-cards' at version 35.7.5. Upon requiring the package, it loads a shim that downloads a platform-specific binary from obfuscated Cloudflare Workers endpoints, writes it to a temporary file with disguised names, sets executable permissions, and spawns it detached via shell commands. A fallback mechanism uses DNS TXT-records from specific domains to deliver payloads. A secondary dropper exists under lib/telemetry.js, masquerading as an analytics SDK, which similarly assembles and executes a base64-encoded payload. The package uses runtime string concatenation and array joins to hide hostnames and API calls, evading static analysis. Any consumer importing this package is subject to arbitrary attacker-controlled code execution on their machine.

Any system that imports this specific version of the package is vulnerable to arbitrary code execution by an attacker. This can lead to full compromise of the affected system, including execution of malicious binaries, potential data theft, persistence, or further malware deployment. The malicious code operates stealthily by downloading payloads from obfuscated hosts and using DNS-based fallback channels, making detection and prevention more difficult.

No official patch or remediation is currently provided. Consumers should immediately avoid using version 35.7.5 of the 'bigops-products-accounts-and-cards' npm package. Remove this package from all projects and dependency trees. Monitor for any usage of this package and replace it with trusted alternatives. Since no vendor advisory or patch is available, patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates. Employ supply chain security best practices such as verifying package integrity and using trusted registries.