Importing the advertised package silently starts a bootstrapper. It downloads or DNS-reconstructs an opaque native payload, writes it to a temporary directory, and executes it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime require/import of the package entrypoint.
Impact
Arbitrary remote code execution under the importing user's privileges.
Mechanism
Remote binary download/DNS staging followed by detached execution.
Attack narrative
The public entrypoint suppresses errors while importing _init.js. Its immediately invoked bootstrap fetches an opaque platform payload from concealed HTTPS mirrors or reconstructs it from DNS TXT records, saves it in a temp directory, grants execute permission on Unix, and launches it detached through a shell or cmd.exe. This is unconsented remote code execution on ordinary package import.
Rationale
The package's documented claims-conversion API does not require a covert native downloader or detached payload execution. The executable payload is remote-controlled and runs automatically at import time.
Evidence
package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints7
oob-worker.cf99-9b3.workers.dev/pkg/package