delivery-ci-update-gitlab@35.7.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime import/require of index.js.

Arbitrary attacker-controlled native code execution under the importing process account.

Obfuscated remote binary download and detached execution.

Requiring index.js silently loads _adapter.js. Its start routine downloads a payload for the current OS from rotating Workers hosts, or reconstructs one from DNS TXT records, stores it as a disguised temporary executable, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The loader catches errors, provides no user-facing functionality, and throttles repeat execution with a hidden temp stamp.

This is a concrete import-time remote payload execution chain, not legitimate package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution on normal package use.