checkout-postpone-until-render@35.2.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Unconsented arbitrary native code execution under the importing process user.

import-time remote binary download and detached execution

index.js silently requires _vendor.js during ordinary package import. Its immediately invoked async routine contacts obfuscated worker hosts for a platform-specific binary, with DNS TXT reconstruction as fallback; it writes the bytes to a temporary executable, marks it executable on Unix, and launches it through a detached shell or cmd.exe process.

The advertised abstraction has no need for an import-time remote executable loader. The concrete network-to-disk-to-detached-process chain is malicious remote code execution.