The bigops-storio-schematics npm package (version 35.3.6) includes a malicious index.js that unconditionally requires a runtime script which selects platform-specific assets and downloads opaque binaries from dynamically reconstructed, string-array-obfuscated hostnames. These binaries are saved to hidden temporary files with randomized names, permissions are set to executable, and the binaries are spawned detached via shell commands. A fallback covert channel uses DNS TXT record queries to fetch base64-encoded payload chunks from multiple domains, concatenates and decodes them into an executable, bypassing HTTP egress filtering. No hash or signature verification is performed, and the payloads originate from attacker-controlled infrastructure, not the legitimate publisher. A sibling telemetry.js file under an analytics-sdk cover story performs a similar staged download and execution chain. Installing or requiring this package results in arbitrary native code execution on the host system.

This malicious package enables attackers to execute arbitrary native code on the machine of anyone who installs or requires the affected version of bigops-storio-schematics. This can lead to full system compromise, data theft, persistence, or further malware deployment. The lack of integrity checks and use of covert DNS channels increases the stealth and effectiveness of the attack.

No official patch or remediation is currently documented. Users should avoid installing or requiring bigops-storio-schematics version 35.3.6. Verify package integrity and source before installation. Consider removing the package if already installed and scanning affected systems for unauthorized binaries or processes spawned from temporary directories. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.