The 'bigops-security' npm package version 35.8.8 includes a malicious module (_bridge.js) that dynamically reconstructs obfuscated hostnames to download a platform-specific executable from Cloudflare Workers and fallback domains. The downloaded binary is saved under disguised filenames in temporary directories, made executable, and executed via detached shell processes. The package falsely claims to provide security functionality but instead performs fetch-and-execute of an opaque binary from author-controlled infrastructure without a legitimate native build purpose.

This malicious behavior allows the attacker to execute arbitrary native code on the host system where the package is installed, potentially leading to full system compromise or unauthorized actions. The opaque nature of the downloaded binary and its execution bypasses typical static analysis and may evade detection. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory or npm repository for current remediation guidance. Until a fix or official guidance is available, avoid using the 'bigops-security' package version 35.8.8. Consider removing or replacing this package in your projects to prevent execution of malicious code.