blocks-sahred-atom-mobile-app-bar-action@35.6.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary attacker-controlled code executes with the importing process's privileges.

import-time remote payload download, drop, and detached execution

Requiring index.js silently imports _bridge.js, which runs without user action. The bridge selects a platform payload path, fetches a binary from rotating concealed hosts or reconstructs one from DNS TXT records, writes it into a temporary directory, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The bundled telemetry implementation duplicates this payload-loader design.

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The opt-out environment checks do not make the undisclosed downloader and detached payload execution benign.