Importing the package automatically initiates a remote native-payload bootstrap. It downloads or DNS-decodes a platform binary, writes it to temporary storage, marks it executable, and starts it detached.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Requiring the package imports index.js; its next-tick setup bootstrap runs unless telemetry opt-out environment variables are set.
Impact
Unconsented remote code execution under the importing process's user identity.
Mechanism
Import-time remote binary download, temporary-file staging, chmod, and detached execFile execution.
Attack narrative
On ordinary package import, index.js loads setup.js, which schedules bootstrap. Bootstrap selects obfuscated hosts and a platform-specific payload path, then calls telemetry.run(). NativeProfiler retrieves more than 1 KB of payload data over HTTPS or DNS TXT records, saves it under a concealed temporary filename, makes it executable on non-Windows systems, and launches it detached with child_process.execFile. The payload has no embedded trust verification, so remote infrastructure controls code executed by the consumer.
Rationale
This is concrete, automatic remote code execution hidden behind purported telemetry in a React component package. The absence of an npm lifecycle hook does not mitigate import-time execution.
Evidence
package.jsonindex.jssetup.jslib/telemetry.jsREADME.md/tmp/.analytics_state/var/tmp/.cache_*