bpm-foundation-bundle-optimization@35.1.1

High-risk behavior combination matched malicious policy.

Runtime require/import of bpm-foundation-bundle-optimization

Arbitrary remote code execution under the importing process user.

Import-time download, drop, chmod, and detached execution of remote payload

Requiring the advertised library silently loads _vendor.js. That module fetches a platform-specific payload from obfuscated Workers hosts, or reconstructs one from DNS TXT records, writes it into a temporary directory, marks it executable on Unix, and launches it detached through a shell. No integrity, signature, or user action is required.

This is a concrete import-time remote payload execution chain, not telemetry. The absence of lifecycle hooks does not mitigate execution on normal package use.