bigops-logs-player@35.2.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import or require of bigops-logs-player.

Arbitrary remote code executes with the importing process user's permissions.

Remote binary download/DNS staging followed by detached execution.

The package's normal entrypoint silently loads _polyfill.js. Its immediately invoked main function selects an OS-specific executable path, fetches a binary from obfuscated workers.dev hosts or reconstructs one from DNS TXT records, writes it under a misleading temporary name, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is an unconsented staged remote-code-execution chain.

The concrete import-time downloader, DNS fallback, payload drop, and detached execution establish malicious behavior independent of scanner labels. The visible logger API does not require this functionality.