claims-format-date@35.6.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js at runtime.

Arbitrary remote code execution as the importing process user.

remote binary download via HTTPS or DNS TXT followed by detached execution

Requiring index.js silently requires _init.js. It creates a temporary marker, downloads a platform-specific binary from obfuscated Workers hosts, or reconstructs one from DNS TXT records, writes it under /var/tmp or Windows Temp, marks it executable on Unix, and starts it detached via shell/cmd. This is a concrete remote code-execution chain independent of any user-facing API.

The benign-looking exported API is a wrapper around import-time remote payload execution. The telemetry file contains the same downloader/runner pattern but is not needed to establish the reachable attack.