Importing the main package automatically launches a remote payload loader. It downloads a platform-specific executable, writes it to a temp directory, and starts it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import of index.js.
Impact
Unconsented arbitrary native code execution under the importing user's privileges.
Mechanism
Remote binary download, DNS fallback, temp-file execution
Attack narrative
The harmless-looking entrypoint silently imports _ext.js. That module immediately calls main(), retrieves a large platform-specific payload over HTTPS or DNS TXT records, stores it in a temporary location, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The source conceals endpoints by splitting strings and suppresses failures, leaving no legitimate package function tied to this behavior.
Rationale
This is a concrete import-time staged payload execution chain, not ordinary telemetry. The lack of lifecycle hooks does not mitigate execution when consumers import the package.
Evidence
package.jsonindex.js_ext.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>
Network endpoints8
oob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/package/pkg/package