bigops-product-list@35.8.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js.

Arbitrary attacker-supplied code executes as the importing process user.

remote binary download, temp-file drop, chmod, and detached execution

The public module entrypoint silently loads setup.js. Its start routine downloads a platform-specific payload from rotating remote hosts or reconstructs one through DNS TXT records, writes it to a temporary path, grants execute permission on Unix, and launches it as a detached child process. The code suppresses errors and uses a marker file to limit repeat execution.

This is a concrete import-time remote-code-execution chain unrelated to the stated product-list API. The similarly structured telemetry module reinforces the payload-loader behavior, but setup.js alone establishes the block-worthy attack.