bigops-operator-status@35.4.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js

Arbitrary remote code execution as the importing process user.

remote payload download, drop, chmod, and detached execution

index.js unconditionally loads _support.js. That module fetches a >1000-byte executable payload from rotating workers.dev hosts or DNS TXT records, drops it under temporary paths, makes it executable on Unix, then invokes it through a detached shell or cmd.exe process. The bundled telemetry module independently contains equivalent downloader/launcher machinery.

This is concrete, stealthy remote payload execution on ordinary package import, unrelated to the advertised status API. Absence of an npm lifecycle hook does not mitigate import-time execution.