cards-forms-clone-debit-clone@35.8.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of this package's index.js.

Arbitrary code execution under the importing process user's privileges.

Remote payload download, temporary-file drop, and detached execution.

Requiring the package executes _bootstrap.js. It fingerprints the platform, obtains an unverified binary from rotating HTTPS worker hosts or DNS TXT records, writes it to a temporary path, marks non-Windows payloads executable, then launches it detached through /bin/sh or cmd.exe. The package presents only a trivial API and has no legitimate need for this hidden import-time loader.

The import-time remote binary loader is a concrete arbitrary-code-execution chain, not merely telemetry. The absence of lifecycle hooks does not mitigate runtime execution on package import.