bigops-storio-ngrx@35.2.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary remote code executes with the importing process's privileges.

import-time remote binary download, DNS fallback, and detached execution

The main entrypoint silently requires _ext.js. Its immediately invoked setup routine fetches a payload from obfuscated external hosts, with DNS TXT records as a fallback. If the payload exceeds a size threshold, it writes it to a temporary executable path, applies execute permission on Unix, and launches it detached through a shell or cmd.exe. The loader suppresses errors and logs, and uses a timestamp file to reduce repeated activity.

This is a concrete import-time staged payload downloader and executor, not package-aligned telemetry. The analogous native-extension loader in lib/telemetry.js reinforces the intended remote execution chain.