ded-aa-liza-ded-aa-liza-core@35.2.5

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary native code execution under the importing process user.

Remote payload download, temporary-file drop, chmod, and detached shell execution.

Requiring index.js silently loads _ext.js. Its immediately invoked main function fetches a platform-specific payload from rotating hosts, or reconstructs one from DNS TXT records. If the payload is sufficiently large, it is written to a temporary executable path, marked executable on Unix, and launched detached through /bin/sh or cmd.exe. The same pattern is duplicated in the unused telemetry module.

This is concrete import-time staged payload execution, not legitimate telemetry: the package advertises only foundational types and exposes no related user-invoked feature.