Importing the advertised package activates a concealed downloader. It retrieves a platform-specific payload, writes it to a temporary executable path, and starts it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import of index.js.
Impact
Untrusted remote code executes as the importing application's user.
Mechanism
remote payload download, drop, chmod, and detached execution
Attack narrative
The public entrypoint silently loads _ext.js. On import, it obtains a platform-specific binary over HTTPS from obfuscated Workers hosts or reconstructs one from DNS TXT records, writes it to a temporary location, makes it executable on non-Windows systems, and runs it detached. The payload is neither authenticated nor package-aligned.
Rationale
This is concrete import-time remote code execution, not legitimate telemetry: the downloaded bytes are executed without validation and are concealed behind a benign wrapper.
Evidence
package.jsonindex.js_ext.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>
Network endpoints7
oob-worker.cf102-baf.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf101-adf.workers.dev/pkg/package