The bigops-tslint npm package (version 35.9.4) advertises itself as a lint tool but includes malicious code that unconditionally requires a module which selects a platform-specific payload path. It downloads an opaque binary from obfuscated Cloudflare Workers domains, reconstructing hostnames at runtime to evade static analysis. The binary is saved to temporary directories with disguised filenames, permissions are set to executable, and it is spawned detached via shell commands. A secondary dropper with similar download and execution logic is bundled in telemetry.js. This results in arbitrary code execution on the host system when the package is installed or required, unrelated to its advertised functionality.

Any system with bigops-tslint version 35.9.4 installed or running should be considered fully compromised. The attacker gains arbitrary code execution, potentially leading to full system control. All secrets and keys stored on the compromised system should be rotated from a different, trusted machine. Removing the package does not guarantee removal of all malicious artifacts or backdoors.

Remove the bigops-tslint package version 35.9.4 immediately. Rotate all secrets and keys that were stored or accessible on the compromised system from a secure environment. Because the attacker may have persistent access, a full system audit and potential rebuild is recommended. No official patch or fix is indicated; avoid using this package version entirely.