The bigops-products-travel npm package version 35.7.1 includes a malicious loader script (_loader.js) that, upon requiring the package's main entry, downloads a platform-specific binary from multiple obfuscated Cloudflare Workers domains. It also uses a DNS TXT-record fallback mechanism involving attacker-controlled domains to reconstruct a base64 payload. The downloaded binary is saved to disguised file paths (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), permissions are set to executable, and it is spawned detached via shell commands. There is no version pinning or integrity verification (no hash or signature checks). The malicious behavior is hidden by opt-out environment variable checks and a modification time-based rate limit. The delivery infrastructure is fully attacker-controlled and unrelated to the package's legitimate functionality.

This malicious package can execute arbitrary code on the host system by downloading and running attacker-controlled binaries without verification. This can lead to system compromise, persistence, and potentially further malicious activities. The lack of integrity checks and obfuscation techniques increase the risk of undetected exploitation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.7.1 of bigops-products-travel from their environments and avoid using this package. It is recommended to audit dependencies for malicious code and verify package integrity before installation. Monitor for any unusual processes spawned by this package and investigate any suspicious activity. Patch status is not yet confirmed — check the vendor advisory or trusted sources for current remediation guidance.