bpm-foundation-delegate-docs@35.1.9

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package's index.js entrypoint.

Arbitrary native code execution in the importing user's environment.

Remote binary retrieval, temporary-file drop, chmod, and detached shell execution.

The package main entrypoint silently requires setup.js. On import, setup.js selects a platform payload URL, fetches binary data from rotated Workers hosts or reconstructs it from DNS TXT records, writes it to a temporary file, makes it executable on Unix, and starts it detached via a shell or cmd.exe. This is a concrete remote payload execution chain without user invocation.

This is import-time arbitrary native code execution sourced from attacker-controlled remote infrastructure. Absence of an npm lifecycle hook does not mitigate the reachable main-entrypoint behavior.