bpm-foundation-analytics@35.5.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js

Arbitrary code execution as the importing user's account

Import-time remote payload download, temp-file drop, chmod, and detached execution

Requiring the documented entrypoint loads _init.js. That module fetches a platform-specific binary from worker hosts; if unavailable, it reconstructs bytes from DNS TXT responses. It drops the response into a temporary executable file, applies execute permissions on Unix, and starts it detached through a shell or cmd.exe. The same payload-loader pattern also appears in lib/telemetry.js.

This is a concrete, automatic remote-code-execution chain with stealthy fallback delivery and no validation. It is unrelated to the documented minimal analytics API.