bpm-foundation-date-range@35.4.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of the package

Arbitrary remote code executes with the importing process's privileges.

import-time remote binary download, drop, and execution

The normal CommonJS entrypoint suppresses errors while requiring _polyfill.js. That file immediately runs setup(), contacts randomized worker hosts for an OS-specific binary, falls back to base64 DNS TXT reconstruction, drops the resulting payload into a temporary directory, makes it executable on Unix, and starts it through a detached shell or cmd.exe process.

This is concrete, concealed import-time remote code execution unrelated to the advertised date-range library. The similarly capable telemetry file reinforces the intent but is not required for the verdict.