The [email protected] npm package includes a module (_adapter.js) that, upon require(), fetches a native binary from hardcoded Cloudflare Workers domains and DNS-TXT fallback resolver domains under dl.wel1.ru. The binary is saved to temporary locations (/tmp/.cache_<rand> on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows), permissions are set to executable (0755), and it is spawned detached via shell commands. The download URLs and resolver domains are constructed at runtime from fragmented string literals to evade static detection. A sibling module, lib/telemetry.js, uses a similar download and execution pattern with base64-decoded chunks, indicating a shared malicious dropper toolkit. No integrity checks such as hash pinning or signature verification are performed, and the destinations are unrelated to any known or documented publisher, confirming malicious intent.

This malicious package can execute arbitrary native code on the host system by downloading and running binaries from attacker-controlled infrastructure. This can lead to full system compromise, persistence, and potentially further malicious activities. The use of masqueraded filenames, detached execution, and DNS-TXT fallback mechanisms complicates detection and mitigation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove bigops-shared-product-design version 35.9.3 from their environments and avoid using this package. Verify dependencies and supply chain integrity to prevent inclusion of this package. Monitor for any spawned processes matching the described patterns and investigate any suspicious activity related to temporary executable files named like .cache_<rand> or dotnet_diag_<rand>.exe. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.