cards-forms-clone-cards-core-clone@35.4.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary remote code execution under the importing application's user account.

Remote binary download with DNS fallback and detached execution.

The package entrypoint silently loads _platform.js. On import, it selects an OS-specific path, fetches a payload from obfuscated workers.dev hosts or DNS TXT records, stores it in a temporary location, sets executable permissions on non-Windows systems, and launches it via a detached shell or cmd.exe process. No payload integrity verification or user action is required.

This is an import-time remote payload loader and execution chain unrelated to the advertised minimal framework module. The absence of lifecycle scripts does not mitigate the reachable runtime RCE.