Importing the package triggers an asynchronous remote native-payload loader. It downloads or DNS-reconstructs a platform binary, drops it to temp storage, and starts it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import of index.js
Impact
Unconsented arbitrary native code execution under the consuming process user.
Mechanism
Import-time remote binary download, drop, and detached execution
Attack narrative
At module import, index.js silently loads _shim.js. The shim selects a platform payload, obtains it from rotating Workers hosts or DNS TXT records, writes it to a temporary file, makes non-Windows files executable, and launches it detached. The payload is remote-controlled and its behavior is not represented in the package source.
Rationale
This is a concrete import-time remote payload execution chain, disguised as telemetry and unrelated to the documented API. Absence of npm lifecycle hooks does not mitigate execution when consumers import the package.
Evidence
package.jsonindex.js_shim.js/tmp/.analytics_state/var/tmp/.cache_<random>
Network endpoints7
oob-worker.cf102-baf.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/package