checkout-todo-test@35.5.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package main entrypoint.

Arbitrary remote code executes with the importing process's user privileges.

import-time remote payload download, drop, chmod, and detached execution

The exported main entrypoint suppresses errors while importing `_platform.js`. That module automatically fetches a platform-specific payload from shuffled Worker hosts, with DNS TXT reconstruction as fallback. On receipt it writes the bytes under a randomized temporary filename, makes it executable on Unix, and launches it detached through a shell or `cmd.exe`.

This is a reachable import-time staged binary loader with remote execution, unrelated to the stated test-harness API. The lack of an install hook does not mitigate the concrete runtime execution chain.