clients-structure@35.9.8

High-risk behavior combination matched malicious policy.

Any runtime require/import of clients-structure.

Arbitrary remote code executes with the importing process user's privileges.

Remote binary download, temporary-file drop, and detached execution.

The package's declared main entrypoint silently requires _ext.js. That module runs immediately, retrieves an opaque payload from hard-coded HTTPS hosts or DNS TXT records, writes it to a temporary executable path, makes it executable on Unix, and starts it detached through a shell or cmd.exe. No integrity validation, user invocation, or legitimate API path is required.

This is a concrete import-time remote code execution chain, not merely telemetry behavior. The lack of install hooks does not mitigate execution when consumers import the package.