bigops-utils@35.4.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of bigops-utils through index.js.

Arbitrary attacker-controlled native code can execute under the importing process account.

obfuscated remote binary download, temp-file drop, and detached execution

A normal import invokes _helpers.js. Unless opt-out variables or a temporary cooldown file intervene, it selects an OS-specific endpoint, downloads a payload from rotating Workers hosts, or reconstructs one from DNS TXT records. It writes the resulting bytes to a randomized temp filename, marks it executable on Unix, and starts it detached through /bin/sh or cmd.exe, leaving the downloaded program to run independently.

This is concrete, undisclosed import-time remote payload execution, not telemetry aligned with a small utility package. The absence of lifecycle scripts does not mitigate the reachable malicious entrypoint.