bigops-nitro-client@35.6.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Untrusted remote code executes with the privileges of the importing Node process.

remote binary download, drop, chmod, and detached execution

Requiring index.js silently imports _vendor.js. Its bootstrap routine downloads an unsigned binary from rotating workers.dev hosts, or reconstructs one from DNS TXT records, then writes it to a temporary hidden/random path, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The marker file and suppressed errors make execution quiet and rate-limited.

This is concrete import-time remote payload execution unrelated to the advertised client abstraction. Opt-out environment checks and lack of an npm lifecycle hook do not mitigate the runtime compromise.