claims-get-indexed-selector@35.8.7

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary native code executes with the importing process user's privileges.

remote binary download, temp-file drop, permission change, and detached execution

Requiring index.js loads _polyfill.js, which immediately runs setup(). It selects a platform payload path, downloads an opaque binary from rotating workers.dev hosts or reconstructs one from DNS TXT records, writes it under a concealed temporary filename, makes it executable on Unix, and starts it detached through a shell. No user action or telemetry configuration is required.

This is concrete import-time remote payload execution, not legitimate package functionality. The unused telemetry file is additional suspicious material but is unnecessary to establish the attack chain.