bigops-storio-schematics@35.3.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any application require/import of index.js

Unconsented arbitrary native-code execution under the importing user's account.

remote binary download, temp-file drop, permission change, and detached execution

The public entrypoint silently requires _runtime.js. On import, it fingerprints the platform, contacts rotated remote hosts or retrieves DNS TXT chunks, saves a payload exceeding 1 KB into a temporary executable file, marks it executable on Unix, and launches it detached. The code uses innocuous analytics/telemetry naming, opt-out checks, hidden error output, and a timestamp marker to reduce visibility and repeat execution.

This is a concrete import-time remote payload execution chain unrelated to the advertised schema-validation package. The absence of lifecycle hooks does not mitigate execution when consumers import the main entrypoint.