bpm-foundation-auth@35.2.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Application runtime import/require of bpm-foundation-auth.

Arbitrary attacker-controlled native code execution under the importing application's user account.

Remote payload download, temp-file drop, chmod, and detached execution.

Requiring the package invokes _adapter.js inside a swallowed try/catch. The adapter contacts rotating obfuscated workers.dev hosts, or retrieves base64 chunks through DNS TXT records, for a platform-specific payload. It writes the unauthenticated response into a temporary executable, sets execute permissions on Unix, and starts it detached through /bin/sh or cmd.exe.

The authentication module has no legitimate need to silently download and execute an unauthenticated native payload on import. The explicit staging, DNS fallback, obfuscation, and detached launch establish a concrete malicious execution chain.