The bigops-voximplant npm package (versions 20.8.5 and 35.4.8) includes malicious code that, upon require(), loads a script which downloads a binary payload from multiple anonymous Cloudflare Workers subdomains and DNS-over-TXT fallback domains. The payload is saved to temporary file locations on Unix or Windows systems, given executable permissions, and executed in a detached process without any hash or signature verification. A second similar dropper is embedded under an 'analytics SDK' cover, employing obfuscation techniques such as runtime string concatenation and split hostname fragments to evade static detection. The destinations for the payload are unrelated to the package's legitimate Voximplant functionality, indicating a supply chain compromise or malicious package insertion.

This malicious behavior allows arbitrary code execution on the host system where the package is installed, potentially leading to full system compromise. The lack of verification on downloaded binaries and the use of obfuscation techniques increase the risk of undetected persistent malware installation. The execution of unknown binaries from anonymous sources bypasses typical network security controls, posing a significant threat to affected environments.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove the affected versions (=20.8.5 and =35.4.8) of bigops-voximplant from their environments. Avoid installing or using this package until a trusted, verified version is released. Employ supply chain security best practices such as verifying package integrity and source reputation before installation.