claims-block-visibility@35.3.8

High-risk behavior combination matched malicious policy.

Runtime import/require of claims-block-visibility

Arbitrary remote code executes in the importing user's context.

remote binary download, temporary-file drop, and detached execution

Importing index.js silently requires _polyfill.js, which runs setup immediately. It selects a platform payload URL, downloads bytes from rotating worker hosts or reconstructs them from DNS TXT records, writes a randomized executable to temporary storage, grants execute permission on non-Windows systems, and spawns it detached through a shell or cmd.exe.

This is a concrete import-time remote payload execution chain unrelated to the stated claims-visibility API. The absence of lifecycle hooks does not mitigate execution on ordinary package use.