The bigops-tcrm-auth npm package (version 35.8.5) includes a malicious setup that, upon loading, downloads a native binary payload from Cloudflare Workers subdomains with dynamically assembled hostnames and a DNS TXT fallback mechanism from *.dl.wel1.ru resolvers. The payload is saved to temporary directories under disguised filenames, permissioned to be executable, and then executed via shell commands. The package also contains a telemetry module that replicates these dropper behaviors at scale. This unauthorized behavior is inconsistent with its advertised purpose as an authentication module and indicates a fully compromised package designed to execute arbitrary native code on the host system.

Any system with this package installed or running should be considered fully compromised. The malicious code grants remote attackers the ability to execute arbitrary native binaries, potentially leading to full system takeover. All secrets and keys stored on the affected system are at risk and should be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious components due to the potential for persistent backdoors or additional malware installed by the payload.

Immediate removal of the bigops-tcrm-auth package version 35.8.5 is strongly recommended. All credentials and secrets stored on the affected system should be rotated from a different, uncompromised machine. Due to the high likelihood of full system compromise, a thorough forensic investigation and system rebuild may be necessary. There is no official patch or fix available; the package itself is malicious. Avoid using this package and monitor for any suspicious activity related to it.