bigops-alerts-widget@35.8.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime require/import of bigops-alerts-widget

Arbitrary native code execution under the importing process user.

remote payload download, drop, chmod, and detached execution

A normal require of index.js silently requires _vendor.js. Its async run routine fetches a platform-specific binary from rotating hard-coded hosts, or rebuilds one from DNS TXT records. It stores the bytes in a temp path, marks Unix files executable, and launches them via shell/cmd as a detached process. A stamp file throttles repeat execution.

This is a concrete, import-triggered remote native payload execution chain unrelated to the advertised widget. The duplicate telemetry implementation corroborates the same downloader/launcher design.