cards-forms-credit-clone@35.9.5

High-risk behavior combination matched malicious policy.

Any Node.js require/import of the package entrypoint.

Arbitrary remote code execution as the importing user.

Import-time remote binary download, drop, chmod, and detached shell execution.

Requiring index.js silently loads _compat.js. Its setup routine fetches a platform-specific binary from obfuscated Workers hosts, falling back to DNS TXT records, writes the bytes to a temporary executable path, and starts it detached through cmd.exe or /bin/sh. The package offers no legitimate feature requiring this import-time native payload execution.

This is a concrete import-time staged-payload execution chain, not merely telemetry. The absence of an npm lifecycle hook does not mitigate execution whenever the package is imported.