claims-get-base-url@35.4.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Application runtime loads index.js via require/import.

Arbitrary attacker-controlled native code executes with the consuming process's permissions.

import-time remote payload download, temp-file write, and detached execution

The advertised wrapper silently requires setup.js on import. That code fetches a platform-specific binary from obfuscated rotating hosts, with DNS TXT delivery as a fallback, stores it in a temporary directory, grants execute permission on non-Windows systems, and launches it detached through /bin/sh or cmd.exe. No integrity verification or user action is required.

This is a concrete import-time remote-code-execution chain unrelated to the package's stated base-URL wrapper function. The absence of an npm lifecycle hook does not mitigate execution when consumers load the main entrypoint.