Importing the package silently launches a remote payload loader. It downloads a platform-specific binary, writes it to temporary storage, and detached-executes it.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Any runtime import/require of index.js.
Impact
Arbitrary attacker-controlled native code executes as the importing process user.
Mechanism
Obfuscated remote binary download and detached execution.
Attack narrative
index.js suppresses errors while importing setup.js. Its main routine uses a timestamp to rate-limit execution, fetches a sufficiently large payload from obfuscated worker hosts or DNS TXT fallback, saves it under a randomized temporary filename, marks it executable on Unix, and launches it detached with output hidden.
Rationale
This is an import-time remote payload loader, not ESLint configuration behavior. Its stealthy download, temporary staging, and detached execution constitute concrete malicious RCE.
Evidence
package.jsonindex.jssetup.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints9
oob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf100-416.workers.dev/pkg/package