bigops-plugin-notification-builder@35.1.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Importing bigops-plugin-notification-builder via its main entrypoint.

Unconsented remote code execution in the importing user's context.

import-time remote binary download, drop, chmod, and detached execution

Requiring the documented package entrypoint loads _bridge.js. Its immediate bootstrap downloads a platform-specific payload from obfuscated workers.dev hosts, or reconstructs one from DNS TXT records under wel1.ru. It writes the payload into a temporary directory, marks Unix files executable, and launches it detached through /bin/sh or cmd.exe while suppressing errors and output.

The package's claimed UI interface does not need an import-time remote binary loader. This is a concrete hidden remote-code-execution chain, not ordinary telemetry.