checkout-mobile-cashback@35.4.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package main entrypoint.

Arbitrary attacker-controlled native code can execute on the importing user's machine.

remote binary download, temporary-file drop, and detached execution

The declared main entry catches and imports _shim.js during normal package import. Its bootstrap contacts shuffled remote hosts for a platform-specific binary, or reconstructs one from DNS TXT records. A sufficiently large response is saved under a disguised random temporary filename, marked executable on non-Windows systems, then launched through a detached shell or cmd.exe process. The marker only rate-limits the behavior; it does not obtain user consent.

This is a concrete import-time staged native payload execution chain unrelated to the small advertised SDK API. The bundled telemetry module independently contains the same downloader/launcher pattern, reinforcing intent.