The bigops-ui-themes npm package (version 35.6.5) includes malicious code that, upon module load, requires a vendor script which constructs obfuscated destination hostnames to download payloads from multiple external endpoints. The payloads are saved to temporary directories under deceptive filenames and executed with elevated permissions. The package also contains dormant telemetry code that mimics the dropper behavior, reinforcing the cover story of being an analytics SDK. Execution is throttled via a marker file to avoid repeated runs. The obfuscation techniques used aim to evade static detection. This behavior effectively grants full control of the compromised system to an external attacker.

Any system with this package installed or running is considered fully compromised. The attacker may have gained full control over the system, including access to stored secrets and keys. Removal of the package does not guarantee elimination of all malicious artifacts or backdoors introduced by the payloads. Immediate rotation of all secrets and keys stored on the compromised system is necessary to mitigate further risk.

Remove the bigops-ui-themes package version 35.6.5 immediately from all affected systems. Consider all systems with this package installed as fully compromised. Rotate all secrets, keys, and credentials that were stored or used on these systems from a separate, trusted environment. Conduct a thorough forensic investigation to identify and remediate any persistent malicious components. There is no official patch or fix available; remediation relies on removal and incident response.