The bigops-ui-kit-styles npm package (version 35.5.7) is a malicious package that, when required, loads a script (_compat.js) which dynamically constructs URLs to fetch a platform-specific executable from obfuscated Cloudflare Workers subdomains with a DNS TXT fallback mechanism. This executable is saved under misleading filenames in temporary system directories, given executable permissions, and launched detached from the main process. The package exports a no-op stub class and contains no actual UI components, indicating its sole purpose is to perform remote code execution on the host system. This behavior effectively compromises any system that installs or runs this package.

Any system with this package installed or running is considered fully compromised. The attacker gains remote code execution capabilities, potentially allowing full control over the affected machine. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not fully remove the attacker’s presence or any additional malware installed as a result of this compromise.

Remove the bigops-ui-kit-styles package version 35.5.7 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised machines from a secure, unaffected environment. Due to the high likelihood of persistent compromise, consider rebuilding affected systems from known good backups or reinstalling the operating system to ensure complete remediation. Monitor for any signs of persistent backdoors or additional malicious activity.