The bigops-ui-themes npm package version 35.6.5 contains malicious code that downloads and executes payloads from obfuscated external hosts. It writes these payloads to temporary directories with misleading filenames and executes them, potentially compromising the host system. The package masquerades as an analytics SDK with dormant code that also attempts to drop and execute malicious payloads. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately.