checkout-test-component@35.9.8

High-risk behavior combination matched malicious policy.

Any application importing the main entrypoint (index.js).

Arbitrary native code execution with the importing user's privileges.

import-time remote binary download, drop, chmod, and detached execution

The benign-looking entrypoint silently requires _runtime.js. On import, it retrieves an opaque executable from hard-coded worker hosts or DNS TXT records, drops it to a temporary path, marks it executable on Unix, and starts it detached through a shell or cmd.exe. This is an unconsented remote payload execution chain.

Direct inspection confirms an import-time downloader/executor unrelated to the declared test-component API. The absence of lifecycle hooks does not mitigate runtime arbitrary-code execution.