bigops-products-bnpl@35.2.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package entrypoint.

Arbitrary attacker-controlled native code runs as the importing process user.

silent download-to-temp and detached execution of an unsigned remote binary

The benign-looking entrypoint silently loads _runtime.js. Its top-level start routine selects a platform payload, downloads it from obfuscated hard-coded hosts or reconstructs it from DNS TXT records, writes it to a temp path, makes it executable on Unix, and launches it detached through a shell or cmd.exe. Failures are swallowed, reducing visibility.

The package contains an import-triggered, unauthenticated remote-payload execution chain with no legitimate relationship to its documented API. Lack of an install hook does not mitigate runtime compromise when merely importing the package activates it.