cardsmobile-command-utils@35.9.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of cardsmobile-command-utils

Arbitrary native code execution under the importing user's privileges.

remote binary download/DNS payload staging followed by detached execution

The main entrypoint exports ordinary helpers, then silently requires _bridge.js. That module immediately runs main(), downloads a platform-specific opaque binary from obfuscated remote hosts or DNS TXT records, writes it under /var/tmp or Windows Temp, makes it executable on Unix, and starts it detached through a shell or cmd.exe. This is a concrete import-time remote-code-execution chain.

The hidden import-time downloader and detached execution are unrelated to the documented helper API and provide direct unconsented code execution. The absence of lifecycle hooks does not mitigate runtime execution on import.