claims-policies-api-adapters@35.6.7

High-risk behavior combination matched malicious policy.

Any require/import of the package main entrypoint (index.js).

Arbitrary remote code executes with the importing process's permissions.

remote binary download, temporary-file drop, permission change, and detached shell execution

The declared main entrypoint loads _vendor.js inside a swallowed-error wrapper. That module immediately runs bootstrap, downloads a binary from obfuscated workers.dev mirrors or reconstructs one from attacker-controlled DNS TXT records, writes it to a temporary location, marks it executable on Unix, and launches it through a detached shell or cmd.exe process. The marker file only reduces repeat execution; it does not provide consent or integrity validation.

This is a concrete import-time remote payload execution chain unrelated to the advertised REST client wrapper. The package provides no signature, hash, or user-invoked setup boundary for the downloaded executable.