bigops-timeline@35.4.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of bigops-timeline.

Arbitrary attacker-controlled native code execution in the importing user's environment.

Remote binary download via HTTPS/DNS followed by detached execution.

At package import, index.js silently loads _helpers.js. That module fetches a platform-specific binary from obfuscated worker hosts, falling back to DNS TXT records that reconstruct base64 payload bytes. It writes the payload to a temp path, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. Failures are suppressed, obscuring the behavior.

This is concrete import-time remote payload execution, unrelated to the declared timeline API. The unused telemetry module contains a parallel downloader/executor implementation, reinforcing intentional malicious capability.