bigops-tcrm-identity-auth@35.9.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of index.js

Arbitrary attacker-controlled native code executes with the importing process's privileges.

remote binary download, drop, and detached execution

A normal require of index.js suppresses errors while loading _bootstrap.js. That module contacts obfuscated remote hosts for a platform-specific payload, with DNS TXT as a fallback, drops the received binary into a temp directory, and invokes it detached through cmd.exe or /bin/sh. This is an unconsented remote-code execution chain.

The import-time loader is concrete, stealthy remote binary execution unrelated to the stated session-management purpose. The lack of npm lifecycle hooks does not mitigate execution when consumers import the package.