capacity-capacity-core@35.3.7

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package main entrypoint.

Arbitrary code execution as the importing process user.

remote binary download, drop, chmod, and detached execution

The declared main entrypoint imports _adapter.js at module load. Its setup routine selects an OS-specific payload path, fetches bytes from obfuscated Workers hosts or reconstructs them from DNS TXT records, stores the payload under an inconspicuous temporary filename, grants execute permission on Unix, and starts it through a detached shell or cmd.exe process. Errors are suppressed and a timestamp marker limits repeat execution.

This is a concrete import-time remote code-execution chain, not ordinary telemetry: arbitrary remote bytes are executed without integrity verification or user invocation. The lack of install hooks does not mitigate the runtime import trigger.