contract-contract-builder@35.5.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary attacker-controlled native code can execute as the consuming process user.

import-time remote payload download, drop, and detached execution

When a consumer imports index.js, its guarded require immediately loads _platform.js. That module contacts rotating worker hosts for a platform-specific binary and, on failure, reconstructs bytes from DNS TXT records on wel1.ru domains. It saves a payload in a temporary directory, makes non-Windows payloads executable, and starts it detached through a shell or cmd.exe. The same remote-binary execution pattern also exists in the unreferenced telemetry implementation.

This is concrete, automatic remote payload execution unrelated to the declared UI-toolkit functionality. The absence of lifecycle hooks does not mitigate the import-time execution path.