The bigops-ui-kit npm package (version 35.9.2) is a malicious package that acts as a remote code execution dropper. On requiring the package, it loads a compatibility script that dynamically constructs URLs to download native payloads from obfuscated, non-standard hosts. These payloads are saved to disguised file paths in temporary directories, made executable, and launched in a detached process. The package uses obfuscation techniques such as string concatenation and indirect imports to hide its malicious behavior. Execution is controlled by environment variables and a stamp file, but once triggered, it grants full host compromise to attackers. This package does not contain legitimate UI code despite its advertised purpose.

Any system that installs and imports the bigops-ui-kit package version 35.9.2 is fully compromised with remote code execution capabilities granted to an attacker. This includes potential unauthorized access to all secrets, keys, and sensitive data stored on the affected machine. The attacker can execute arbitrary native code with the privileges of the user running the package, leading to complete system takeover.

There is no official patch or fix available for this malicious package. The package should be immediately removed from all systems. All secrets and keys stored on affected machines should be considered compromised and rotated from a separate, trusted environment. Due to the nature of the compromise, a full system reinstallation or forensic analysis is recommended to ensure removal of any persistent malicious artifacts. Avoid installing or importing this package in any development or production environment.