The bigops-storio package (version 35.8.7) includes a malicious dropper in its _support.js module that dynamically selects one of several obfuscated workers.dev endpoints to fetch an opaque binary payload over HTTPS. If HTTPS delivery fails, it falls back to reconstructing the payload from base64-encoded DNS TXT records from multiple dl.wel1.ru subdomains. The payload is saved under a hidden random filename in the system's temporary directory, permissions are set to executable, and it is spawned detached using shell commands without standard input/output. This execution occurs automatically during the package load via index.js requiring _support.js. There is no integrity verification of the fetched payload, and the behavior is unrelated to the package's intended storio abstraction functionality.

This malicious behavior allows arbitrary code execution on any system that installs and requires bigops-storio version 35.8.7. The attacker can run any binary payload fetched from external servers, potentially leading to full system compromise, data theft, or further malware deployment. The lack of integrity checks and obfuscation techniques complicate detection and prevention.

No official patch or remediation is currently documented. Users should immediately avoid using bigops-storio version 35.8.7 and remove it from their environments. Since the package fetches and executes remote code without verification, it is unsafe to use. Monitor for any unexpected processes spawned from temporary directories and consider scanning affected systems for the malicious payload. Check for vendor advisories or updates for official fixes.