The bigops-products-investment npm package at version 35.3.1 loads a script (_vendor.js) that fetches platform-specific executables from multiple Cloudflare Workers domains. The hostnames are constructed dynamically to evade static detection. The downloaded binaries are saved to temporary directories with disguised names, permissions set to executable, and then spawned detached without standard input/output. If HTTPS fetching fails, the package falls back to retrieving base64-encoded executable chunks via DNS TXT records from several domains, concatenates and decodes them, then executes the resulting binary. The package includes a telemetry.js file that is not referenced, and telemetry opt-out environment variables only gate the fetch-and-execute behavior, which is not genuine telemetry but malicious code execution.

This malicious package enables remote code execution on the host system by downloading and running opaque binaries controlled by the attacker. This can lead to full system compromise, unauthorized access, and persistence. The lack of signature or hash verification increases the risk of executing arbitrary code. The use of covert DNS channels as fallback increases stealth and resilience of the malicious payload delivery.

No official patch or remediation is currently documented for this package version. Users should immediately remove and avoid using bigops-products-investment version 35.3.1. Audit and verify all dependencies for supply chain integrity. Employ package integrity verification and restrict execution of downloaded binaries. Monitor for suspicious network activity related to the described domains. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.