claims-policy-details-api-adapters@35.3.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import of index.js

Arbitrary attacker-controlled code execution in the importing user's environment.

remote binary download, drop, chmod, and detached shell execution

At package import, index.js requires _loader.js. Its bootstrap fetches a platform-specific opaque payload from obfuscated external hosts, or reconstructs one from DNS TXT records. It writes the bytes to a temporary executable path, applies execute permission on non-Windows systems, then starts it through a detached shell or cmd.exe process. This creates silent remote code execution without user invocation or payload integrity verification.

The import-time loader is concrete remote payload execution, not package-aligned API behavior. Telemetry code independently contains the same download-and-launch primitive.