ded-pwa-bnpl-forms-demo@35.9.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js

Arbitrary remote code can execute under the importing user's account.

remote binary download/DNS staging followed by temporary-file execution

Requiring index.js immediately loads _support.js. It selects a platform-specific binary path, downloads bytes from obfuscated worker hosts or reconstructs them from DNS TXT records, writes them into a temporary directory, marks Unix payloads executable, and starts them detached through a shell or cmd.exe. A marker file throttles subsequent runs.

The public adapter entry point has no reason to silently retrieve and execute an unsigned native payload. This is a concrete import-time remote-code-execution chain.