The bigops-telephony-ui-adapter npm package (version 35.6.4) includes malicious functionality in its main index.js that unconditionally loads _init.js. This module dynamically selects a platform-specific binary and downloads it from multiple obfuscated external domains assembled at runtime to evade detection. The binary is saved under disguised filenames in temporary directories, permissions are set to executable on POSIX systems, and it is executed detached from the parent process using platform-appropriate commands. If HTTPS download fails, a DNS TXT record fallback channel reconstructs the payload from base64-encoded chunks. The downloaded payload is attacker-controlled, unsigned, and not publisher-hosted, enabling arbitrary code execution on the host. The package includes an environment variable to disable telemetry as a cover story. Any system with this package installed or running is considered fully compromised.

Any system that installs or runs bigops-telephony-ui-adapter version 35.6.4 is subject to arbitrary attacker-controlled code execution. This leads to full compromise of the host, including potential theft or manipulation of secrets, credentials, and keys. The malware operates stealthily by downloading and executing unsigned binaries from obfuscated hosts and using DNS fallback channels. Removal of the package alone does not guarantee eradication of the malware or attacker persistence.

There is no official patch or fix available for this malicious package. Immediate removal of bigops-telephony-ui-adapter version 35.6.4 from all systems is recommended. All secrets, keys, and credentials stored on affected systems should be considered compromised and rotated immediately from a clean, uncompromised environment. Monitor for any signs of persistence or additional malware installed as a result of this compromise. Exercise caution when installing npm packages and verify package integrity and provenance before use.