bigops-products-travel@35.7.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package entrypoint.

Arbitrary native code execution under the importing process user.

Remote payload download, temporary-file drop, and detached shell execution.

Requiring index.js silently loads _loader.js. Its bootstrap routine contacts obfuscated remote worker hosts for a platform-specific binary, with DNS TXT payload reconstruction as fallback. It writes the payload to a temporary file, makes non-Windows files executable, and launches it detached through /bin/sh or cmd.exe. A timestamp file throttles repeated executions and errors are suppressed.

The import-time loader implements an unconsented remote native-payload execution chain. No install hook is required because ordinary package import triggers it.