Importing the package automatically starts a remote binary download-and-execute chain. It uses HTTPS with DNS TXT fallback, then runs the fetched platform-specific file detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime import/require of bigops-products-savings-accounts.
Impact
Unconsented arbitrary code execution with the importing process user's privileges.
Mechanism
remote payload retrieval, temporary-file drop, chmod, and detached execution
Attack narrative
A normal require of index.js silently requires _ext.js. Its top-level setup function fetches a platform-specific binary from hard-coded remote hosts, or retrieves base64 chunks through attacker-controlled DNS TXT records. It drops the bytes into a temporary directory, grants execute permission on Unix, and launches the file detached via /bin/sh or cmd.exe. The marker file merely throttles execution and opt-out variable names disguise the behavior as telemetry.
Rationale
Source establishes an import-reachable, network-delivered arbitrary native payload execution chain. No lifecycle hook is needed for this concrete runtime compromise.
Evidence
package.jsonindex.js_ext.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe