The bigops-watermark npm package (version 35.9.5) includes malicious code that triggers on module load. It fetches an opaque binary payload from multiple obfuscated and string-assembled external domains, writes it to temporary storage with disguised names, sets executable permissions, and spawns it detached via shell commands. No integrity checks such as hash or signature verification are performed. The package uses string fragment concatenation to evade static analysis and employs environment variable names as camouflage. Additionally, a duplicate dropper implementation exists in lib/telemetry.js, mirroring the active payload but currently unreachable from the main import path. This behavior effectively grants full control of the compromised system to an external attacker.

Systems with this package installed or running are fully compromised, as the malicious payload executes with the ability to run arbitrary code. This compromises all secrets and keys stored on the system, necessitating immediate rotation from a clean environment. Removal of the package alone does not guarantee eradication of the malicious software or attacker persistence.

Remove the bigops-watermark package version 35.9.5 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems from a separate, trusted environment. Conduct a thorough investigation and remediation of the affected systems, as the malicious payload may have established persistence beyond the package itself. Patch status is not applicable as this is a malicious package rather than a vulnerability with an official fix.