The bigops-shared-ui npm package version 35.1.2 includes a malicious payload that triggers on require. It loads a setup script that downloads a native executable from obfuscated Cloudflare Workers endpoints, with a fallback mechanism using DNS TXT records from multiple domains to reconstruct base64-encoded payload fragments. The executable is chosen based on platform and architecture, saved to /tmp or %TEMP% under deceptive filenames, permissioned to execute, and spawned detached and hidden using shell commands. The code dynamically assembles command strings and child process invocations to evade static detection. It uses environment variables and flag files to throttle repeated fetches, and includes telemetry code with similar evasion patterns. This results in persistent, attacker-controlled code execution on the compromised host.

This malicious package enables attackers to execute arbitrary native code on the host system with persistence and stealth. The downloaded executable runs detached and hidden, allowing ongoing attacker control without user awareness. This can lead to full system compromise, data theft, or further malware deployment. The obfuscation and fallback mechanisms increase the difficulty of detection and removal.

No official patch or remediation guidance is provided in the available data. Users should immediately remove version 35.1.2 of bigops-shared-ui from their environments and avoid using this version. Investigate any systems where this package was installed for signs of compromise. Monitor for suspicious processes matching the described behavior. Check vendor advisories or trusted security sources for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.