bigops-products-timeline@35.8.9

High-risk behavior combination matched malicious policy.

Any runtime require/import of bigops-products-timeline.

Arbitrary attacker-controlled native code executes under the importing process account.

remote payload download, drop, chmod, and detached execution

The normal module entrypoint silently loads _vendor.js. On import, that file marks a temporary stamp, fetches a platform-specific binary from rotated endpoints (or reconstructs one from DNS TXT records), writes it to a temporary path, makes it executable on Unix, and starts it detached through a shell or cmd.exe. The payload and remote controller are attacker-selected.

This package’s documented timeline API is inert, while its import-time side effect is a concealed cross-platform downloader and executor. The lack of lifecycle hooks does not mitigate runtime arbitrary-code execution.