bigops-activity-headers-interceptor@35.6.8

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary native code execution as the importing process user.

import-time remote binary download and detached execution

When a consumer imports index.js, its try-require invokes _helpers.js. That module selects a platform payload path, attempts HTTPS downloads from obfuscated hard-coded hosts, and falls back to DNS TXT payload retrieval. If it receives more than 1000 bytes, it drops the bytes into a temporary executable, marks it executable on Unix, and launches it in a detached shell process.

The advertised interceptor has no functional connection to hidden import-time remote executable delivery. This is a concrete remote-code-execution chain, not merely telemetry behavior.