The bigops-products-insurance npm package version 35.3.4 includes malicious code in its index.js file that loads _ext.js. This script downloads a platform-specific binary from hardcoded, obfuscated remote hosts assembled at runtime to evade detection. It uses DNS TXT-record chunked base64 as a fallback delivery method. The binary is saved to /var/tmp or %TEMP% with disguised names (e.g., dotnet_diag_<tag>.exe on Windows) and given executable permissions before being executed detached via shell commands. Environment variables with telemetry-like names are used to mask the malicious activity as diagnostics. Installing or importing this package results in arbitrary attacker-controlled code execution on the host machine.

An attacker can execute arbitrary code on the system of any user who installs or imports the affected package version, potentially leading to full system compromise, data theft, or further malware deployment. This is a direct remote code execution risk triggered by the package's installation or usage.

No official patch or remediation is currently documented. Users should avoid installing or importing bigops-products-insurance version 35.3.4. Investigate alternative trusted packages or versions. Monitor package sources carefully and verify package integrity before use. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.