bigops-tinkoff-telephony-mock@35.5.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any application code that requires/imports the package.

Unconsented arbitrary native code execution under the importing user's account.

Remote binary download, DNS fallback, temp-file drop, and detached execution.

Requiring index.js silently imports _runtime.js. That module runs immediately, selects a platform payload path, downloads bytes from obfuscated Workers hosts or reconstructs them from DNS TXT records, saves a payload in a temporary directory, makes it executable on Unix, and starts it detached via a shell or cmd.exe. The state stamp only throttles repeat execution.

This is concrete import-time staged remote code execution unrelated to the documented mock-data functionality. The lack of an npm lifecycle hook does not mitigate execution when consumers import the package.