bigops-status-selection@35.3.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Unconsented remote code execution under the importing process user.

silent download-to-temp detached binary execution

The public entrypoint catches and suppresses a require of _bootstrap.js, but that module immediately runs bootstrap(). It fingerprints the platform, fetches a binary from rotating hosts or obtains base64 data through DNS TXT records, writes it to a temporary path, chmods it on Unix, and launches it detached. This is an import-time staged payload execution chain unrelated to the package's stated status-selection API.

Direct source inspection confirms a concrete, silent import-time remote binary download and execution chain. The absence of npm lifecycle scripts does not mitigate runtime execution when consumers import the advertised entrypoint.