delivery-ci-upgrade-from@35.6.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any application require/import of the package main entrypoint.

Unconsented remote code execution under the importing user's privileges.

import-time remote binary download and detached execution

The declared main, index.js, silently requires _bridge.js during import. Its bootstrap downloads a platform-specific binary over HTTPS from rotating hosts, or reconstructs one from DNS TXT records, writes it to temporary storage, makes it executable on Unix, and launches it detached through a shell or cmd.exe. This is a concrete remote payload execution chain.

The package's import path directly activates an obfuscated remote binary downloader and executor. The absence of an install hook does not mitigate runtime compromise on normal import.