The bigops-products-timeline-commons npm package (version 35.1.6) includes a malicious loader that runs automatically when the package is imported. This loader constructs obfuscated hostnames to download platform-specific binaries over HTTPS without any integrity checks. The binaries are saved to temporary directories with filenames impersonating legitimate tools and executed in a detached manner. The loader also uses a DNS TXT-record covert channel as a fallback for data retrieval. The package's API surface is a decoy, with the true malicious activity occurring during import, effectively acting as an install/import-time remote code execution dropper.

This malicious package enables remote code execution on any system that imports it, potentially allowing attackers to run arbitrary code with the privileges of the importing process. The use of obfuscated domains, covert DNS channels, and disguised filenames complicates detection and forensic analysis. The lack of binary verification increases the risk of executing tampered or malicious payloads.

No official patch or remediation is currently documented. Users should avoid using version 35.1.6 of bigops-products-timeline-commons. Audit dependencies for this package and remove or replace it if found. Employ supply chain security measures such as verifying package integrity and using trusted sources. Monitor for updates or advisories from the package maintainers or security vendors for remediation guidance.