bigops-microfrontend@35.4.1

High-risk behavior combination matched malicious policy.

Any runtime require or import of the package entrypoint.

Arbitrary native code executes with the importing process's privileges.

remote binary download, temp-file drop, and detached shell execution

The declared entrypoint loads _shim.js automatically. The shim selects a platform payload, downloads it from rotating worker hosts, and falls back to DNS TXT reconstruction. It writes the received bytes to a temporary executable path, marks non-Windows files executable, and starts them detached through cmd.exe or /bin/sh. No integrity or signature verification is performed.

This is a concrete, import-triggered remote payload execution chain rather than ordinary telemetry. The lack of an npm lifecycle hook does not mitigate execution on normal package use.