The bigops-web-analytics package (npm ecosystem) version 35.9.4 includes malicious functionality triggered on require(). It loads a helper script that selects platform-specific endpoints and fetches a binary payload from obfuscated, string-split hosts. The payload is saved to temporary files on Linux or Windows systems with disguised filenames and executed detached via shell commands. No integrity checks are performed on the downloaded payload. The package suppresses error output and uses a cover story unrelated to its actual behavior. This results in full compromise of any system running this package, with attackers gaining remote code execution and persistence.

Systems with this package installed or running are considered fully compromised. Attackers may have full control over the system, potentially accessing all stored secrets and keys. Removal of the package alone does not guarantee eradication of all malicious components or backdoors. Immediate secret/key rotation from a separate, uncompromised system is advised.

Remove the bigops-web-analytics package version 35.9.4 immediately from all affected systems. Rotate all secrets and keys stored on compromised systems from a different, trusted environment. Due to the nature of the compromise, assume full system compromise and consider rebuilding affected systems. No official patch or fix is currently available; patch status is not yet confirmed — check vendor advisories for updates.