bigops-products-timeline-commons@35.1.6

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package entrypoint.

Arbitrary code execution as the consuming application's user.

Remote payload download, drop, chmod, and detached execution.

The package entrypoint silently loads _loader.js during normal import. The loader fetches a platform-specific binary from obfuscated worker domains, or reconstructs one from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and runs it through a detached shell process. This is a concrete remote-code-execution chain without user invocation or integrity verification.

Source inspection confirms an import-time, silent remote payload execution chain unrelated to the package's stated shared-primitives purpose. The absence of npm lifecycle hooks does not mitigate runtime arbitrary code execution.