checkout-context@35.5.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js

Unconsented remote code execution under the importing process user.

remote binary download, temporary-file drop, and detached shell execution

Requiring index.js silently imports _helpers.js. Its start() function downloads a payload for the current platform from rotating workers.dev hosts, or reconstructs one from DNS TXT records. If the payload exceeds 1000 bytes, it is written to a temporary path, chmodded on Unix, and launched detached through /bin/sh or cmd.exe. This is remote code execution without user action.

The import-time helper forms a complete remote-payload download, drop, and execution chain unrelated to the advertised context wrapper. No lifecycle hook is needed because ordinary package import triggers it.