bigops-storio-ngrx-component-store@35.3.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

require/import of index.js

Arbitrary attacker-controlled native code executes as the importing user's account.

remote payload download, disk drop, and detached shell execution

A normal import reaches _helpers.js. Unless opt-out variables or a recent marker suppress it, the helper retrieves a platform-specific binary from hard-coded Workers endpoints, or reconstructs one from DNS TXT records, writes it to a temporary path, grants execute permission on Unix, and starts it through a detached shell or cmd.exe. The similarly structured telemetry module reinforces that this is an intentional payload-loader pattern.

The malicious chain is directly reachable from the main entrypoint and needs no install hook or explicit user command. The package’s stated state-container purpose does not justify arbitrary remote native payload execution.