checkout-create-draft-agreement-am@35.1.1

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package.

Arbitrary native code execution under the importing process user.

remote binary download, drop, and detached execution

At import time, index.js requires _polyfill.js. That module obtains a platform-specific executable from obfuscated Workers hosts or reconstructs one from DNS TXT records, writes it into temporary storage, makes it executable on Unix, and launches it through a detached shell or cmd.exe process. The broad error suppression and fake telemetry framing conceal the behavior.

This is a concrete import-time remote payload execution chain unrelated to the advertised adapter. No install hook is needed because requiring the normal entrypoint triggers it.