bigops-videocalls@35.9.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary native code executes with the importing process's privileges.

Import-time remote binary download, drop, and detached execution.

A consumer merely importing the advertised module causes index.js to load _support.js. That module contacts rotating remote hosts for a platform-specific payload, then falls back to DNS TXT records carrying base64 data. On receipt it writes the payload to a temporary file, makes Unix payloads executable, and launches it detached through /bin/sh or cmd.exe, hiding output.

This is a concrete, import-time remote-code-execution chain unrelated to the package's stated videocalls adapter function. The lack of lifecycle hooks does not mitigate execution on normal use.