The bigops-products-timeline package (version 35.8.9) includes a malicious payload triggered on require(). It loads a _vendor.js script that downloads a platform-specific binary from dynamically reconstructed Cloudflare Workers URLs, with a DNS TXT fallback resolving to *.dl.wel1.ru domains. The binary is saved under disguised filenames in temporary directories, made executable, and executed detached via shell commands. The obfuscation techniques used aim to evade static detection mechanisms. This fetch-and-execute behavior is not required for the package's stated functionality, indicating intentional malicious activity.

The malicious code enables arbitrary code execution on the host system by downloading and running external binaries without user consent. This can lead to system compromise, data theft, persistence, or further malware deployment. Because the binaries are executed detached, detection and containment may be more difficult. The obfuscation of download URLs complicates detection by static analysis tools.

No official patch or remediation guidance is provided. Users should immediately remove and avoid using version 35.8.9 of the bigops-products-timeline package. Audit systems for any signs of execution of unknown binaries from temporary directories. Consider blocking network requests to the identified domains and Cloudflare Workers endpoints. Monitor for suspicious processes spawned from temporary files named like .cache_<hex> or dotnet_diag_<hex>.exe. Replace the package with a trusted alternative or a clean version if available.