devplatform-api-clients@35.6.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary remote code executes with the importing process's privileges.

remote binary download, temporary-file drop, and detached execution

Requiring index.js silently requires setup.js. That module downloads a platform-specific payload from obfuscated worker hosts, or reconstructs one from DNS TXT records, stores it under a disguised temporary filename, makes it executable on Unix, and launches it through a detached shell process. The activity is only gated by opt-out variables and a short-lived marker, not an explicit user action.

This is a concrete import-time remote-payload execution chain, not normal telemetry. The absence of lifecycle scripts does not mitigate execution when consumers import the package.