checkout-molecule-mobile-status-sheet@35.7.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Importing or requiring index.js.

Arbitrary native code execution under the consuming application's user account.

Remote binary retrieval, temporary-file drop, chmod, and detached shell execution.

At import time, index.js requires _compat.js. Its run() function obtains a platform-specific payload over HTTPS from rotating hosts or reconstructs one from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it detached via shell or cmd.exe. The payload is neither authenticated nor user-invoked.

This is concrete import-time remote code execution, disguised as telemetry compatibility behavior. The lack of an install hook does not mitigate execution when any consumer imports the package.