bigops-storio@35.8.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary native code execution as the consuming application's user.

remote binary download, drop, and detached execution

On ordinary package import, index.js silently loads _support.js. That module contacts rotating workers.dev hosts for a platform-specific binary and, if unavailable, reconstructs one from DNS TXT records on .ru domains. If the payload exceeds 1000 bytes, it writes it under a randomized temporary filename, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The marker only rate-limits repeats; it does not prevent the initial execution.

This is an import-time, unauthenticated remote binary execution chain with stealthy host obfuscation and DNS fallback. It is concrete malware behavior, not telemetry required by the stated library API.