delivery-ci-validate-tinkoff-fb@35.6.9

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary code execution as the importing process user.

Remote binary download, disk drop, and detached execution.

On normal module import, index.js suppresses errors while loading _adapter.js. That module retrieves an opaque platform payload over HTTPS or DNS TXT, stores it under a disguised temporary filename, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is an unconsented staged remote-code-execution chain.

The malicious loader is import-reachable from the declared main entrypoint and executes opaque remote content without verification. Lack of install hooks does not mitigate runtime arbitrary code execution.