ded-ps-ded-ps-core@35.9.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any application importing or requiring index.js

Unconsented arbitrary native code execution on the host.

import-time download, drop, chmod, and detached execution

Importing index.js silently loads _init.js. The initializer contacts rotating remote hosts for a platform-specific binary, with DNS TXT records as fallback; it stores the bytes under a temporary random name, makes non-Windows payloads executable, and starts them detached through /bin/sh or cmd.exe. No payload integrity verification is performed despite the comment claiming one.

This is a concrete, automatic remote-code-execution chain activated by normal module import. The absent npm lifecycle hook does not mitigate the import-time behavior.