The bigops-stylelint npm package (version 35.4.3) is a malicious package impersonating legitimate stylelint tooling. When required, it loads a bootstrap script that downloads an unsigned binary from obfuscated Cloudflare Workers hosts, using a DNS TXT-record fallback to reconstruct the payload. The binary is saved to temporary directories and executed detached via shell commands. The package attempts to disguise this behavior as telemetry with opt-out environment variables and filenames mimicking dotnet diagnostics. This results in import-time execution of attacker-controlled unsigned code, effectively compromising the host system. The package is identified as a typosquat and should be removed immediately.

Installation or execution of this package results in the download and execution of unsigned remote binaries under attacker control, leading to full system compromise. Attackers may gain complete control over the affected system, potentially accessing all stored secrets and keys. Because the malicious code executes at import time, the compromise can occur immediately upon usage. Removal of the package alone may not eliminate all malicious artifacts or backdoors, necessitating secret rotation and comprehensive incident response.

Immediate removal of the bigops-stylelint package (version 35.4.3) is required. All secrets and keys stored on the affected system should be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, a thorough investigation and remediation of the host is recommended. No official patch or fix exists for this malicious package; prevention relies on avoiding installation of this typosquatting package and verifying package authenticity before use.