bigops-products-mobile@35.6.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import resolving index.js.

Arbitrary remote native code executes under the consuming application's user account.

import-time staged payload download and detached execution

Requiring the declared main entrypoint catches errors while importing _loader.js. That module selects an OS-specific payload endpoint, downloads an opaque buffer from obfuscated Cloudflare-worker hosts or DNS TXT records, writes it to a temporary cache-like filename, marks it executable on Unix, and launches it detached through a shell or cmd.exe. Its stamp file only limits repetition and does not require user consent.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The unused-looking telemetry source contains the same downloader/launcher design, reinforcing intent.