The bigops-storio-ngrx-component-store npm package (version 35.3.4) includes malicious code that triggers on module load. It assembles attacker-controlled hostnames via array-join concatenation to reach multiple obfuscated domains. From these domains, it fetches a platform-specific native executable, writes it to temporary directories under disguised names, sets executable permissions (chmod 0755), and spawns it detached using shell commands. The code uses string concatenation to obscure API calls such as requiring 'child_process' and invoking 'chmodSync'. This fetch-and-execute behavior occurs immediately upon requiring the package, enabling remote code execution through the opaque native binary.

The malicious package enables remote code execution on any system that installs and requires it. The attacker-controlled native binary is fetched and executed with the privileges of the running process, potentially allowing full system compromise. The obfuscation and load-time execution increase the risk of unnoticed infection and persistence. There is no indication of active exploitation in the wild yet, but the presence of such code in an npm package poses a significant risk to developers and production environments using this package version.

No official patch or remediation is currently documented. Users should immediately avoid using bigops-storio-ngrx-component-store version 35.3.4. Remove this package from all projects and replace it with a trusted alternative. Monitor for any unexpected processes or files in temporary directories that match the described patterns. Since no vendor advisory or patch is available, patch status is not yet confirmed — check the vendor advisory or trusted sources for updates. Consider scanning your environment for this package and any spawned binaries to contain potential compromise.