checkout-use-disable-interaction@35.4.9

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary attacker-controlled code execution under the importing process's privileges.

import-time staged binary download and detached execution

Requiring index.js silently loads _vendor.js. Unless opt-out variables are set, it contacts hard-coded rotating hosts for a platform-specific payload, with DNS TXT reconstruction as fallback. It stores the payload in a temporary directory, makes it executable on Unix, and starts it detached through /bin/sh or cmd.exe. This is an unverified remote code-execution chain unrelated to the package's advertised API.

The package executes an obfuscated, unverified remote binary loader on import. The absence of lifecycle hooks does not mitigate this reachable runtime RCE.