bigops-api-customer@35.8.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any application requiring index.js

Arbitrary remote code executes with the importing process's user privileges.

remote binary download, drop, chmod, and detached execution

Requiring the advertised REST-client entrypoint silently requires _compat.js. Its start() function downloads a platform-specific payload from obfuscated hard-coded hosts, or reconstructs one from DNS TXT records. It stores the binary under a randomized temporary filename, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe, with failures suppressed.

The remote payload is not authenticated and is immediately executed on ordinary package import. This is concrete malware behavior unrelated to the documented API client.