bpm-foundation-feedback@35.8.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package.

Arbitrary native code execution under the importing process user.

remote binary download, temporary drop, permission change, and detached execution

The main entrypoint silently loads _adapter.js. On import, it writes a timestamp marker, fetches a platform-specific binary from obfuscated workers.dev hosts or DNS TXT records, stores it under a disguised temporary filename, makes it executable on Unix, and launches it detached through a shell or cmd.exe. This is an unconsented remote-payload execution chain.

Source directly establishes import-time remote binary retrieval and detached execution; no benign package function requires this behavior. The absence of lifecycle hooks does not mitigate the reachable import-time execution.