bigops-storio-store-adapter@35.9.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary attacker-controlled native code can run with the importing process's privileges.

remote payload download, temporary-file drop, permission change, and detached process execution

The normal module entrypoint silently requires _bridge.js. On import, it selects platform-specific endpoints, downloads a binary from hard-coded HTTPS mirrors or reconstructs one from DNS TXT records, writes it to a temporary directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. This is an unconsented remote-code-execution chain; the similarly structured telemetry module corroborates the capability.

The source establishes a reachable, import-time download-and-execute path with attacker-controlled remote payload bytes. Lack of an install hook does not mitigate runtime execution when consumers import the package.