checkout-confirm-pos-order-sms-am@35.6.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Unconsented remote code execution under the importing process's privileges.

Remote binary download or DNS payload recovery, temp-file drop, and detached execution.

On import, index.js loads _init.js. The initializer selects a platform payload endpoint, downloads bytes from rotated Workers hosts or reconstructs them from DNS TXT records, writes the bytes to a temporary executable path, then launches them detached through cmd.exe or /bin/sh. A timestamp marker limits reruns and failures are silently ignored.

This is a concrete import-time remote payload download-and-execute chain unrelated to the package's advertised minimal API. No lifecycle hook is needed because the malicious initializer is reached by normal package import.