cardsmobile-rs-api@35.5.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import of cardsmobile-rs-api via index.js

Arbitrary attacker-controlled native code runs with the importing process's privileges.

Remote binary download, temp-file drop, and detached execution

The public entrypoint requires _support.js during a normal import. That module fetches a platform-specific executable from hard-coded worker hosts, or reconstructs one from DNS TXT records, stores it in a temporary directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. Errors and output are suppressed, while a temp marker throttles repeat execution.

This is concrete import-time remote code execution, not package-aligned telemetry. The similarly structured telemetry module contains the same payload-loader capability but is not needed to establish the active entrypoint chain.