claims-policy-details-domain@35.9.3

High-risk behavior combination matched malicious policy.

Runtime require/import of index.js

Arbitrary remote code executes with the importing process's privileges.

Remote binary download, DNS fallback, temporary-file drop, and detached execution

The public entrypoint suppresses errors while importing _vendor.js. That module immediately runs, contacts rotating worker hosts for a platform-specific binary, falls back to DNS TXT payload reconstruction, writes the result under a misleading temporary filename, and launches it detached via cmd.exe or /bin/sh. This is an unconsented remote-code-execution chain on ordinary package import.

The concrete import-time remote payload download and detached execution are malicious behavior, not package-aligned SDK functionality. Absence of lifecycle hooks does not mitigate the reachable import-time execution.