bigops-tslint@35.9.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any application code that requires/imports bigops-tslint.

Unconsented arbitrary code execution in the importing user's environment.

Import-time remote binary download and detached execution.

The manifest exposes index.js, which silently requires _ext.js at import time. That module fetches a binary from obfuscated Workers hosts, with DNS TXT delivery as fallback, writes it into a temporary executable file, grants Unix execute permission, and starts it detached through /bin/sh or cmd.exe. This gives an attacker controlling the remote response arbitrary code execution whenever a consumer imports the package.

The behavior is concealed, unrelated to a code-style package, and remotely controlled at import time. Absence of npm lifecycle hooks does not mitigate this reachable execution chain.