bigops-statements-timeline@35.2.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime require/import of bigops-statements-timeline.

Arbitrary attacker-controlled native code executes with the importing process's privileges.

remote binary download, drop, chmod, and detached execution

Requiring index.js loads _support.js and immediately calls run(). It contacts rotated workers.dev hosts for a platform-specific payload, with DNS TXT reconstruction from wel1.ru as fallback. A payload over 1000 bytes is dropped in a temporary directory, chmodded on Unix, and launched through a detached shell or cmd.exe process. This is concrete remote code execution hidden behind an unrelated state-store package.

The package’s normal import path performs stealthy remote payload retrieval and execution, with no user action or documented need. Obfuscated endpoint construction, DNS fallback, temporary binary names, and suppressed errors reinforce malicious intent.