bigops-products@35.7.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import of the package main entrypoint.

Arbitrary native code can execute as the importing user's account.

Remote binary download/DNS staging followed by detached execution.

The benign-looking main module silently requires _init.js. On import, it selects a platform payload URL, downloads a binary from rotated obfuscated hosts or reconstructs it through DNS TXT records, writes it under a deceptive temporary filename, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. Failures are swallowed and a temporary timestamp marker reduces observable repeats.

This is concrete import-time staged remote code execution, unrelated to the package's minimal documented SDK API. The lack of lifecycle hooks does not mitigate the reachable runtime payload chain.