bigops-procedure-player@35.8.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js

Arbitrary native code execution under the importing process user.

Unauthenticated remote payload download, drop, chmod, and detached execution

On import, index.js silently loads _loader.js. The loader fingerprints the platform, obtains a binary from hard-coded Workers hosts (with DNS TXT fallback), writes it to a temporary path, makes it executable on Unix, and launches it through a detached shell or cmd.exe process. It does not authenticate the downloaded bytes, so the remote operators control code executed on the victim machine.

This is concrete import-time staged remote-code execution unrelated to the advertised minimal SDK. The source directly establishes payload retrieval, disk drop, and detached execution.