The bigops-videocalls npm package version 35.9.9 includes a malicious module (_support.js) that executes at import time. It selects a platform-specific path and downloads a native binary from one of four obfuscated Cloudflare workers.dev hosts, with a DNS TXT fallback channel. The binary is saved to temporary directories under disguised filenames resembling system diagnostics tools, given executable permissions, and executed detached from the main process. Command and control hostnames are dynamically assembled to evade static detection. This behavior results in attacker-controlled native code running on the host, effectively compromising the system. The package's presence indicates a fully compromised environment, necessitating secret rotation and comprehensive remediation.

Any system that installs or runs bigops-videocalls version 35.9.9 is at risk of full compromise due to execution of attacker-controlled native code. This can lead to unauthorized access, data exfiltration, and persistent control by threat actors. Secrets and keys stored on the compromised system should be considered exposed and rotated immediately. Removal of the package does not guarantee full eradication of the malware due to potential persistence mechanisms.

No official patch or fix is currently available. Immediate removal of the bigops-videocalls package version 35.9.9 is recommended. Systems with this package installed should be treated as fully compromised; all secrets and keys must be rotated from a separate, trusted system. Comprehensive incident response and forensic analysis should be conducted to identify and remove any additional malicious components. Monitor for any suspicious activity related to the dropped binaries and command and control communications.