The bigops-status-selection npm package version 35.3.2 includes a malicious _bootstrap.js script that selects a platform-specific path and downloads a binary from one of three hardcoded *.workers.dev hosts. If the primary download fails, it uses a DNS TXT-record fallback mechanism over *.dl.wel1.ru subdomains to retrieve a base64-encoded payload in chunks. The binary is saved to /tmp or %TEMP% with disguised filenames such as .cache_<tag> or dotnet_diag_<tag>.exe, permissions are set to executable (0755), and it is launched detached via shell commands (/bin/sh -c or cmd /c start). Hostnames are obfuscated by splitting strings to evade static detection. The code comments misleadingly describe this behavior as analytics or telemetry.

This malicious code enables arbitrary binary execution on the host system when the package is required, potentially allowing attackers to execute arbitrary code with the privileges of the process running the npm package. This can lead to system compromise, data theft, or further malware deployment. The obfuscation and fallback mechanisms increase the difficulty of detection and removal.

No official patch or remediation guidance is provided. Users should avoid using bigops-status-selection version 35.3.2 and remove it from their environments. Verify dependencies and replace with trusted alternatives. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.