delivery-ci-storyshots@35.3.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of delivery-ci-storyshots.

Arbitrary native code execution under the importing process account.

Import-time remote binary download, temporary drop, chmod, and detached shell execution.

When the package is imported, index.js silently loads _adapter.js. Its init function creates a cooldown marker, fetches a platform-specific payload from obfuscated workers.dev hosts or reconstructs one from DNS TXT records, writes it into temporary storage, makes it executable on Unix, and launches it detached via /bin/sh or cmd.exe.

This is a concrete import-time staged-payload execution chain unrelated to the package’s stated interface. Absence of an npm lifecycle hook does not mitigate execution on normal module import.