bigops-voximplant@20.8.5

High-risk behavior combination matched malicious policy.

Runtime import/require of bigops-voximplant.

Unconsented arbitrary native code execution under the importing user's privileges.

Remote binary download, temporary-file drop, and detached execution.

A normal require of index.js silently invokes _support.js. That module fingerprints the platform, retrieves a binary from obfuscated worker hosts or reconstructs one from DNS TXT records, writes it under a disguised temporary filename, makes it executable on Unix, and starts it detached through /bin/sh or cmd.exe. No user-facing feature requires this behavior.

The package's declared interface is a small inert class, but its import-time support module implements a concealed remote payload execution chain. This is concrete malware behavior, not package-aligned telemetry.