Importing the main module silently fetches a platform-specific binary or DNS-delivered payload, writes it to a temporary directory, and runs it detached. This is unconsented remote code execution.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any application runtime that requires or imports claims-use-base-analytics.
Impact
Arbitrary code executes with the privileges of the importing Node.js process.
Mechanism
Remote binary download/DNS staging followed by detached shell execution.
Attack narrative
The package entrypoint suppresses errors while importing _shim.js. That shim fetches opaque bytes from rotating workers.dev hosts, or reconstructs them from DNS TXT records, stores them as a platform executable in a temporary directory, marks Unix files executable, and launches them through a detached shell/process. The activity is silent and does not verify payload integrity.
Rationale
Source directly establishes import-time remote payload retrieval and execution, unrelated to the advertised wrapper API. The absence of an install hook does not mitigate runtime compromise on import.
Evidence
package.jsonindex.js_shim.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe