The bigops-statements-timeline npm package version 35.2.4 includes malicious functionality in its index.js file, which loads a support script that dynamically constructs URLs to download native binaries from multiple anonymous Cloudflare Workers subdomains and a DNS TXT chunked-base64 fallback domain. The binaries are saved under temporary file paths with obfuscated names, permissioned for execution, and then launched detached via shell commands. This behavior leads to arbitrary attacker-controlled native code execution on any system that installs or requires this package.

Any system that installs or requires bigops-statements-timeline version 35.2.4 is at risk of arbitrary native code execution by an attacker. This can lead to full compromise of the host environment, including unauthorized access, data theft, or further malware deployment. The malicious code evades static analysis by reconstructing URLs at runtime and uses multiple fallback mechanisms to ensure payload delivery.

No official patch or remediation is currently documented for this malicious package version. Users should immediately avoid installing or requiring bigops-statements-timeline version 35.2.4. Remove any existing installations of this package from systems. Monitor for and block network connections to the identified Cloudflare Workers subdomains and the fallback DNS domain if possible. Check vendor advisories or trusted security sources for updates or official fixes.