claims-get-error-string@35.5.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Unconsented remote code execution as the importing application's user.

Remote binary download, temporary drop, chmod, and detached execution.

Requiring index.js silently loads _ext.js. Its bootstrap routine rate-limits with a temp stamp, fetches a platform-specific binary from hard-coded worker hosts or DNS TXT records, writes it under /var/tmp (or Windows Temp), marks it executable on Unix, and spawns it detached through /bin/sh or cmd.exe. The bundled telemetry module contains the same downloader-and-launcher pattern.

The malicious loader is import-reachable and performs unverified remote payload execution without user consent. Lack of npm lifecycle hooks does not mitigate runtime compromise.