claims-jira-service@35.8.3

High-risk behavior combination matched malicious policy.

Any runtime require/import of claims-jira-service

Arbitrary native code execution as the importing process user.

remote payload download, disk drop, chmod, and detached shell execution

index.js loads _ext.js during ordinary import. _ext.js fetches a platform-specific payload from rotating workers.dev endpoints or reconstructs one from DNS TXT records, writes it to a temporary directory, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. Its telemetry labels and opt-out variables do not change that executable-payload chain.

The malicious execution chain is directly reachable from the main entrypoint and requires no user opt-in. No integrity verification is performed despite the source comment claiming one.