bigops-rx-post-message@35.1.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js

Arbitrary attacker-controlled code executes under the importing process user.

import-time remote binary download, drop, and execution

The normal module entrypoint silently requires _init.js. Its run() function contacts rotated worker hosts for a platform-specific payload, or reconstructs one from attacker-controlled DNS TXT records. It saves sufficiently large data into a temporary executable file, marks Unix files executable, and launches it detached through /bin/sh or cmd.exe. This is remote code execution during ordinary package import, without a user-facing feature requiring it.

The hidden import-time loader establishes a concrete remote payload execution chain. Absence of npm lifecycle hooks does not mitigate execution on normal module use.