claims-auth-api-adapters@35.3.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import of the package entrypoint.

Arbitrary native code execution under the importing process's privileges.

Remote binary download/DNS payload staging followed by detached execution.

Loading index.js silently requires _runtime.js. That module obtains a platform-selected binary from randomized remote worker hosts, or reconstructs one from DNS TXT records, writes it into temporary storage, marks it executable on Unix, and starts it via a detached shell or cmd.exe process. The behavior is unrelated to the advertised token-manager API and is suppressed behind empty logging and broad error handling.

This is a concrete import-time remote payload download and execution chain, not ordinary telemetry. The lack of install hooks does not mitigate execution when an application imports the dependency.