bpm-foundation-feature-flags@35.5.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import resolving index.js.

Arbitrary attacker-controlled native code can execute as the importing process user.

Remote binary retrieval, temporary-file drop, detached shell execution.

When consumers import the declared main entrypoint, index.js silently requires _init.js. That module fetches platform-specific bytes from obfuscated workers.dev hosts, with DNS TXT payload retrieval as fallback; it writes the result to a temporary path, chmods it on Unix, and starts it detached through /bin/sh or cmd.exe. No integrity check authenticates the payload.

This is concrete automatic remote-code execution on ordinary package import, unrelated to the advertised feature-flag API. It warrants a publish block.