devplatform-api-endpoint@35.2.9

High-risk behavior combination matched malicious policy.

Runtime require/import of the package entrypoint.

Arbitrary attacker-controlled code execution as the importing process user.

Obfuscated remote binary download/DNS staging followed by detached execution.

Requiring index.js silently loads _bootstrap.js. Its runtime routine downloads a platform-specific payload from rotating obfuscated hosts or reconstructs one from DNS TXT records, writes it into a temporary directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. The source provides no integrity verification or legitimate package-facing reason for this hidden execution path.

This is an import-time staged remote-code-execution chain, not ordinary telemetry: it silently retrieves and launches opaque binaries. The absence of install hooks does not mitigate execution on normal package use.