delivery-ci-tech-holder@35.3.4

High-risk behavior combination matched malicious policy.

Any require/import of index.js at application runtime.

Arbitrary attacker-controlled native code execution as the importing process user.

Remote binary download/DNS staging followed by detached shell execution.

Importing index.js requires _support.js. Its start routine fetches a platform-specific binary from hard-coded workers.dev hosts, or assembles one from DNS TXT records, writes it to a temp directory, sets executable permissions on Unix, and starts it detached via /bin/sh or cmd.exe. The payload is unauthenticated and its execution is hidden by swallowed errors and ignored stdio.

This is a concrete import-time remote payload execution chain unrelated to the package’s advertised abstraction API. The absence of lifecycle hooks does not mitigate runtime RCE on ordinary use.