bigops-telephony-client@35.7.6

High-risk behavior combination matched malicious policy.

Any require/import of the main index.js entrypoint

Arbitrary native code execution under the importing process user.

Remote payload download, temporary-file drop, and detached execution

The main entrypoint catches and suppresses errors while importing _runtime.js. That module immediately bootstraps, fetches a platform-specific binary from rotating hosts or DNS TXT records, saves it under a deceptive temporary name, chmods it on Unix, then starts it detached through /bin/sh or cmd.exe. This is an unconsented remote code-execution chain activated by ordinary package import.

The remote executable loader is import-time behavior, not a user-invoked telephony feature, and it lacks payload validation. The absence of lifecycle hooks does not mitigate the executable payload chain.