bigops-web-analytics@35.9.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js, unless an opt-out environment variable is set.

Unconsented arbitrary remote code execution under the importing process's user.

Import-time HTTPS/DNS payload download and detached native execution.

The main entrypoint silently imports _helpers.js. That module immediately downloads a platform-specific binary from hard-coded remote hosts, falls back to assembling one from DNS TXT records, writes it into a temporary directory, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The same remote-download-and-execute design also appears in lib/telemetry.js.

This is a concrete import-time remote code execution chain unrelated to the documented minimal analytics API. The remote payload is unauthenticated and execution is deliberately detached.