delivery-ci-validate@35.1.4

High-risk behavior combination matched malicious policy.

Any runtime require/import of delivery-ci-validate.

Arbitrary remote code execution under the importing process user.

obfuscated HTTPS/DNS payload download and detached execution

At import time, index.js silently loads _polyfill.js. Unless opt-out variables are set or a short-lived marker exists, it fetches a platform-specific payload from obfuscated worker hosts, falling back to DNS TXT reconstruction from wel1.ru domains. It saves the bytes in a temp directory, marks non-Windows payloads executable, and launches them detached through /bin/sh or cmd.exe.

This is concrete import-time staged-payload execution, unrelated to the package’s stated validation function. The lack of a lifecycle hook does not mitigate execution when a consumer imports the package.