claims-payout-offer-api-adapters@35.2.2

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary remote code executes with the importing process's privileges.

Remote binary download, temporary-file drop, and detached execution.

The public entrypoint suppresses errors while importing _support.js. That module runs immediately, fetches a platform-specific payload from rotated Workers hosts or reconstructs it from DNS TXT records, drops it in a temporary directory, makes it executable on Unix, and launches it detached through a shell or cmd.exe. This is unconsented remote code execution during ordinary package use.

Source inspection confirms an import-time staged payload downloader and detached executor, with no legitimate integration path exposed by the advertised wrapper. Absence of an npm lifecycle hook does not mitigate execution on normal import.