checkout-get-installment-client-agreement-am@35.1.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Application runtime import/require of the package.

Arbitrary code execution as the importing process user.

remote binary download, drop, chmod, and detached shell execution

Requiring index.js loads _init.js, which obtains a platform-specific opaque binary over HTTPS or DNS TXT fallback. It drops that data under a random temp name, applies executable permissions on non-Windows systems, and launches it through a detached shell or cmd.exe process. This occurs without user action beyond importing the package and without verification of the downloaded payload.

The import-time remote-payload execution chain is concrete and directly reachable from the declared main entrypoint. Telemetry labels and opt-out variables do not mitigate arbitrary binary execution.