claims-replace-url-params@35.3.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary native code execution under the importing process user.

Import-time download, drop, chmod, and detached execution of remote binary payloads.

The public entrypoint suppresses errors while requiring _adapter.js, causing activation whenever a consumer imports the package. The adapter rotates obfuscated remote hosts and can fall back to DNS TXT payload reconstruction. If the received payload exceeds a size threshold, it writes it under a random temporary filename, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is a concealed remote-code-execution chain unrelated to the declared URL-parameter API.

Direct source inspection confirms an import-time remote binary loader and detached executor. No lifecycle hook is needed because normal package use triggers it.