bigops-opening-file-handler@35.9.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any application requiring/importing bigops-opening-file-handler.

Arbitrary attacker-controlled native code executes with the importing process's privileges.

Import-time remote payload download, drop, and detached execution.

The public index.js silently requires _support.js. Its top-level start() routine contacts obfuscated Workers hosts for a platform-specific binary, or reconstructs one from DNS TXT records. It rate-limits with a temp stamp, writes the payload to /var/tmp or the Windows temp directory, makes Unix payloads executable, and launches them detached through /bin/sh or cmd.exe.

This is a concrete import-time staged remote-code-execution chain unrelated to the advertised handler API. The absence of an npm lifecycle hook does not mitigate execution on normal package import.