The 'bigops-products-bnpl' npm package version 35.2.9 includes code in its index.js that loads a runtime script which selects a platform-specific endpoint from four hardcoded Cloudflare Workers domains to download an opaque binary. This binary is saved under disguised filenames in temporary directories, given executable permissions, and executed detached via shell commands. The destination hostnames are constructed dynamically to evade static detection, and no hash or signature verification is performed. The package masquerades this behavior as telemetry or analytics functionality, but it effectively enables arbitrary attacker-controlled code execution on the host system upon loading the package.

This vulnerability allows an attacker to execute arbitrary code on any system that installs and requires the affected package version, potentially leading to full system compromise. Because the malicious payload is downloaded and executed without verification, the attacker can change the payload at will, increasing the risk and impact. There are no known exploits in the wild reported at this time.

No official patch or remediation is currently available. Users should avoid installing or requiring version 35.2.9 of the 'bigops-products-bnpl' package. Consider using alternative trusted packages or verifying package integrity before use. Monitor vendor advisories for any future updates or fixes.