bigops-watchdog-angular@35.4.8

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package entrypoint.

Arbitrary attacker-controlled code executes as the importing process user.

Import-time remote binary download, drop, chmod, and detached execution.

The main entrypoint silently requires _vendor.js. Its immediately invoked setup routine selects a platform payload path, retrieves bytes from rotating HTTPS hosts or DNS TXT records, drops them into a temporary executable, and launches them detached through cmd.exe or /bin/sh. This is a concrete import-time remote-code-execution chain, not ordinary telemetry.

The package contains a concealed, automatic remote binary loader reached from its main entrypoint. No lifecycle hook is needed because normal package import triggers execution.