certificates-revocation-sw@35.6.4

High-risk behavior combination matched malicious policy.

Runtime import/require of certificates-revocation-sw

Arbitrary native code execution as the importing process user.

remote binary download, disk drop, and detached execution

The main entrypoint catches and suppresses errors while requiring _bootstrap.js. That module fetches a >1000-byte platform payload from rotating obfuscated Workers hosts or DNS TXT records, writes it to a temporary executable path, marks it executable on Unix, and spawns it detached. This is unconsented remote native-code execution on import.

The package’s declared certificate API is unrelated to its import-time downloader/launcher. No lifecycle hook is needed because requiring the main entrypoint triggers the malicious chain.