checkout-commit-pos-order-am@35.8.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary attacker-controlled native code executes as the importing user.

Remote payload download, temporary-file drop, and detached execution.

The package’s ordinary import path loads _shim.js, whose top-level call starts an asynchronous downloader. It tries obfuscated workers.dev endpoints and then DNS TXT records for platform-specific payload bytes, stores a sufficiently large result under /var/tmp or the Windows temp directory, marks Unix payloads executable, and starts them detached through /bin/sh or cmd.exe.

This is concrete import-time remote code execution concealed behind an unrelated wrapper API. The absence of lifecycle scripts does not mitigate execution when consumers import the package.