The bs-bs-core npm package at version 35.1.6 includes malicious functionality where, upon requiring the module, it dynamically constructs Cloudflare Workers hostnames and attempts to download a platform-specific executable via HTTPS. This executable is saved in temporary directories with randomized filenames, permissions are set to executable, and it is spawned detached using shell commands. The package uses string concatenation and splitting to obfuscate critical API calls such as child_process spawning and chmod operations to evade static analysis. The downloaded binary lacks signature verification or hash pinning and is not officially documented or published by the package maintainer, strongly indicating malicious code execution embedded within the package.

Users who install and require bs-bs-core version 35.1.6 risk automatic download and execution of an unknown and unsigned binary on their systems. This can lead to unauthorized code execution, potential system compromise, and persistence via a stamped file gating re-execution. The obfuscation and lack of verification increase the risk of undetected malicious activity and supply chain compromise.

No official patch or remediation is currently documented. Users should immediately avoid using bs-bs-core version 35.1.6 and remove it from their environments. Investigate any systems where this package was installed for signs of compromise. Monitor for updates or advisories from the package publisher or security vendors. Since no patch is confirmed, users must rely on removal and avoidance until an official fix or advisory is released.