bigops-legacy-telephony-panel@35.5.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import of the package entrypoint (require/import).

Arbitrary remote code can execute with the importing process's privileges.

remote payload download, temporary-file drop, and detached execution

The public entrypoint suppresses errors while requiring _init.js. That module immediately contacts obfuscated Workers endpoints, then DNS TXT fallbacks, to obtain a payload larger than 1 KB. It drops the bytes under a randomized temporary filename, marks non-Windows files executable, and launches them detached through cmd.exe or /bin/sh. The payload is neither authenticated nor constrained to package content.

This is concrete import-time remote code execution, not ordinary telemetry: unverified remote bytes are silently executed as a detached process. The absence of an npm lifecycle hook does not mitigate the reachable entrypoint behavior.