delivery-ci-quality@35.6.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of delivery-ci-quality.

Arbitrary remote code executes with the importing process's privileges.

Obfuscated remote binary download/DNS staging followed by detached execution.

The main entrypoint catches and suppresses errors while importing _compat.js. That module immediately fetches a platform-specific payload from shuffled obfuscated hosts, falling back to DNS TXT reconstruction, stores it under an innocuous temporary name, makes it executable on Unix, and starts it detached through a shell or cmd.exe. This is an unconsented remote-code-execution chain during normal package use.

The harmless-looking API imports an immediate remote payload loader. Its download, temporary drop, and detached execution behavior is concrete malware behavior rather than legitimate package functionality.