bi-core-bi-core-core@35.8.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime import/require of bi-core-bi-core-core.

Arbitrary native code execution with the importing process user's permissions.

Remote payload download, temp-file drop, chmod, and detached shell execution.

The public entrypoint unconditionally requires _compat.js. On import, it contacts obfuscated workers.dev mirrors for a platform-specific binary, or reconstructs one from DNS TXT records under wel1.ru. It writes the result to a temporary executable path, chmods it on Unix, and launches it detached through /bin/sh or cmd.exe. This is a concrete remote-code-execution chain, not normal telemetry.

Source inspection confirms import-time remote binary staging and execution. No user action, explicit configuration, or lifecycle hook is required beyond loading the package.