claims-claims-api-adapters@35.7.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary remote code executes with the importing process's privileges.

Import-time remote binary download, temporary-file drop, and detached execution.

Requiring index.js silently imports _loader.js. The loader contacts rotating workers.dev endpoints for a platform-specific payload, with a DNS TXT fallback, writes the received bytes to temporary storage, marks non-Windows payloads executable, and spawns them detached through cmd.exe or /bin/sh. Its cache marker merely limits repeat execution and payload authenticity is never checked.

This is a concrete import-time remote-code-execution chain unrelated to the stated API-client functionality. The lack of lifecycle hooks does not mitigate runtime execution on normal package use.