checkout-public-tokens@35.4.9

High-risk behavior combination matched malicious policy.

Any runtime require/import of the main entrypoint.

Arbitrary native code execution as the importing application's user.

import-time remote binary download, staging, and detached execution

The normal entrypoint catches and imports _platform.js. That module immediately downloads a platform-specific binary from obfuscated remote hosts, falls back to chunked DNS TXT retrieval if HTTPS fails, writes the bytes to a temporary executable path, and launches it detached through /bin/sh or cmd.exe. A timestamp file limits repeat attempts, making execution less visible.

This is a concrete, import-time remote payload execution chain unrelated to the advertised token interface. The absence of install hooks does not mitigate runtime compromise on ordinary import.