The bigops-storio-ngrx package version 35.2.2 includes malicious functionality in its index.js file, which loads an auxiliary script (_ext.js) that dynamically selects an OS-specific asset path. It downloads a binary payload from one of three Cloudflare Workers hosts or reconstructs it via a DNS TXT covert channel from multiple subdomains. The binary is saved to temporary system directories with randomized names resembling system diagnostic tools, given executable permissions, and executed detached from the parent process. Host strings are obfuscated to evade static detection, and no integrity checks (hash or signature verification) are performed on the downloaded payload.

This malicious behavior allows arbitrary code execution on the host system when the package is required, potentially leading to system compromise, unauthorized access, or further malicious activities. The stealthy download and execution mechanism increases the risk of undetected infection. No known exploits in the wild have been reported yet.

No official patch or remediation guidance is currently available. Users should avoid using version 35.2.2 of bigops-storio-ngrx. Verify package integrity before installation and consider removing or replacing this package if found in your environment. Monitor for updates from the package maintainer or security advisories for any forthcoming fixes.