bpm-foundation-linters@35.3.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package entrypoint.

Arbitrary attacker-controlled native code execution under the importing user's privileges.

Remote payload download, temporary executable drop, and detached execution.

When an application imports index.js, it silently requires _runtime.js. That module fetches a platform-specific binary from rotating workers.dev hosts, or reconstructs one from DNS TXT records under wel1.ru. It stores the payload in a temporary file, marks it executable on Unix, and starts it through a detached shell or cmd.exe process while suppressing errors. This is concrete remote code execution unrelated to the advertised linter API.

The package has no install hook, but its normal import path performs an unconsented remote-binary download and execution chain. The telemetry naming and opt-out variables do not make this package-aligned behavior.