The 'bigops-tasks' npm package version 35.1.4 includes a malicious payload triggered by requiring the package. It side-effect loads a _vendor.js script that downloads a native binary from obfuscated Cloudflare Workers domains with DNS TXT-record fallback to several Russian-hosted domains. The binary is saved to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmodded to be executable, and launched detached via shell or command prompt. No actual hash or signature verification is performed despite a misleading comment about SHA-256 integrity. The malicious activity is disguised as analytics or telemetry. This results in full compromise of the host machine, allowing attackers full control.

Any system with 'bigops-tasks' version 35.1.4 installed or running is considered fully compromised. Attackers gain the ability to execute arbitrary native code with the privileges of the user running the package. This can lead to theft of secrets, keys, and other sensitive data. Because the malicious binary is downloaded and executed without verification and the package runs code on require, attackers can maintain persistent control. Removal of the package alone may not remove all malicious artifacts or backdoors.

Immediate removal of the 'bigops-tasks' package version 35.1.4 is recommended. All secrets, keys, and credentials stored on the affected system should be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, a full forensic investigation and system rebuild may be necessary. No official patch or fix is available. Users should avoid installing or running this package version. Monitor for any suspicious activity related to the described domains and filenames.