cardsmobile-cardsmobile-core

High-risk behavior combination matched malicious policy.

Any require/import of index.js.

Arbitrary remote code execution under the importing user's privileges.

HTTPS/DNS payload download, temp-file drop, detached shell execution.

The main entrypoint silently requires _shim.js. On import, the shim obtains a platform-specific payload over HTTPS, or reconstructs one from DNS TXT records, writes it beneath /var/tmp or Windows Temp, marks it executable on Unix, and spawns it detached via /bin/sh or cmd.exe. The behavior is unrelated to the documented core API and permits operator-controlled remote code execution.

Confirmed import-time staged payload download and detached execution is concrete malicious behavior, regardless of the absence of npm lifecycle hooks.