The bigops-products-loans npm package version 35.6.4 includes malicious code in its index.js that loads _init.js, which downloads a platform-specific binary payload from obfuscated Cloudflare Workers subdomains and DNS TXT record fallbacks. The payload is base64-assembled from split DNS TXT records, saved under disguised filenames in temporary directories, permissioned as executable, and spawned detached via system shell commands. A TTL marker file prevents repeated execution, and an environment variable disables telemetry as a cover. Additionally, a secondary dropper is bundled in lib/telemetry.js, disguised as an analytics SDK, which also assembles and executes a payload but is not currently triggered by the main require path.

This malicious package can execute arbitrary platform-specific binaries on the host system, potentially leading to unauthorized code execution and system compromise. The use of obfuscated network locations and DNS TXT record assembly techniques makes detection and analysis more difficult. The secondary dropper increases persistence and stealth capabilities. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official advisory is available, avoid using the bigops-products-loans package version 35.6.4. Remove any installations of this package from your environment and monitor for suspicious activity related to execution of unexpected binaries from temporary directories. Consider blocking network access to the identified Cloudflare Workers subdomains and suspicious DNS TXT record queries as a temporary mitigation.