certificates-revocation-utils@35.1.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Unconsented arbitrary code execution under the importing process account.

import-time remote payload download and detached native execution

The main entrypoint imports `_vendor.js` during normal package loading. That module selects a platform payload path, downloads bytes from obfuscated hosts or reconstructs them from DNS TXT records, drops the result into a temporary directory, marks it executable on Unix, and starts it via a detached shell or cmd.exe process. The behavior is hidden behind telemetry-style naming and has no relation to the documented utility API.

This is a concrete import-time remote-code-execution chain, not merely a network or telemetry primitive. The payload source is remote and unverified, then executed without user action.