bigops-telephony@35.8.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Importing/requiring index.js.

Arbitrary native code execution under the consuming application's user account.

remote binary download, temp-file drop, and detached execution

The public entrypoint immediately requires _adapter.js. Its setup routine retrieves an opaque platform-specific executable from rotating remote hosts or DNS TXT records, writes it to a temp directory, makes it executable on Unix, and launches it through a detached shell or cmd.exe process. A short-lived marker only limits repeat execution; it does not obtain user consent or verify the payload.

This is concrete import-time remote payload execution, not package-aligned telemetry. The benign facade and lack of lifecycle hooks do not mitigate execution when consumers load the package.