The bigops-products npm package version 35.7.4 includes malicious functionality in its _init.js file that downloads a platform-specific binary from Cloudflare Workers hosts whose hostnames are dynamically assembled at runtime to evade static detection. If that fails, it uses a DNS-TXT covert channel to reconstruct a base64-encoded payload from numbered subdomains of dl.wel1.ru. The binary is saved under obfuscated filenames in temporary directories (/tmp or %TEMP%), permissions are set to executable (chmod 755), and it is spawned detached from the main process using shell commands. Telemetry evasion is implemented through marker files and environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK). The dynamic hostname construction via array.join is designed to defeat static string scanning. This behavior represents a malicious package with embedded backdoor capabilities.

This malicious code enables arbitrary code execution on systems that install and run the affected bigops-products package version 35.7.4. The downloaded binary runs detached and could perform unauthorized actions without user knowledge. The use of covert DNS channels and dynamic hostname construction complicates detection and analysis. This poses a significant risk of system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented for this issue. Users should immediately avoid using bigops-products version 35.7.4 and remove it from their environments. Monitor for and block network connections to the identified Cloudflare Workers hosts and the dl.wel1.ru domain. Employ runtime detection for unexpected spawned processes from npm packages. Check vendor advisories for updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.