cards-forms-cards-core-clone@35.3.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js

Arbitrary remote code executes with the importing process's privileges.

remote payload download, temporary-file drop, and detached execution

The public entrypoint suppresses errors while importing a concealed runtime loader. That loader contacts rotating remote hosts or DNS TXT records for a platform-specific binary, saves it under a disguised temporary name, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is concrete remote code execution at import time, without user configuration or a declared package feature requiring it.

The source establishes an import-time download-and-execute chain with no payload authentication. The unused telemetry module reinforces the same behavior but is not needed for the verdict.