delivery-ci-microforms@35.3.5

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package entrypoint.

Arbitrary remote code executes with the importing process's user privileges.

Remote payload download, temporary-file drop, and detached native execution.

Requiring index.js silently imports _support.js. It selects a platform payload URL, downloads opaque bytes from rotating workers.dev hosts or reconstructs them through DNS TXT records, writes the bytes to a temporary executable, and launches it detached through /bin/sh or cmd.exe. This creates an import-time remote-code-execution chain without user action.

The import-time downloader/executor is concrete malicious behavior, not package-aligned telemetry. No install hook is needed because normal package use triggers execution.