claims-microgen-templates@35.7.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package entrypoint.

Arbitrary attacker-controlled native code executes under the importing process user.

Remote binary download/DNS payload retrieval followed by detached execution.

The public entrypoint silently imports _compat.js. Unless opt-out environment variables are set, it downloads a platform-specific payload from obfuscated remote hosts or reconstructs one from DNS TXT records, writes it to a temporary executable file, and starts it detached through cmd.exe or /bin/sh. A temp marker throttles further runs.

This is a concrete import-time staged-payload execution chain unrelated to the declared template interface. The absence of lifecycle hooks does not mitigate execution on normal package use.