bigops-umf-statist@35.3.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any application require/import of index.js

Unconsented arbitrary native code execution in the importing application's user context.

remote binary download, drop, chmod, and detached execution

Requiring index.js silently loads _runtime.js. The loader contacts hard-coded HTTPS hosts for a platform-specific payload, falls back to DNS TXT chunk retrieval, writes payload bytes to a temporary executable file, marks Unix files executable, and launches them detached through a shell or cmd.exe. A temp lock only throttles repeat execution.

This is a concrete import-time staged payload chain with remote code execution, unrelated to the advertised abstraction API. The lack of lifecycle scripts does not mitigate execution on normal package use.