Importing the package immediately starts a hidden remote-payload loader. It downloads an OS-specific binary, stores it in temporary storage, marks it executable on Unix, and launches it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import of checkout-promocode-logic.
Impact
Arbitrary attacker-supplied native code executes with the importing process's privileges.
Mechanism
import-time remote binary download and detached execution
Attack narrative
When an application imports index.js, its suppressed-error require loads _ext.js. That module immediately calls start(), selects a platform payload path, fetches a binary from rotating Cloudflare Worker hosts or reconstructs one from DNS TXT records, writes it to temporary storage, grants execute permission on Unix, and launches it through a detached shell or cmd.exe process. The loader suppresses output and limits repeats with a temporary timestamp file.
Rationale
This is a concrete import-time staged payload loader with remote native-code execution, unrelated to the advertised logging middleware. The absence of npm lifecycle hooks does not mitigate execution upon normal package use.
Evidence
package.jsonindex.js_ext.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>Windows Temp/analytics_stateWindows Temp/dotnet_diag_<random>.exe