devplatform-api-v1-endpoint@35.9.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime import/require of index.js.

Unconsented arbitrary native code execution in the importing user's environment.

remote binary download, DNS fallback, temp-file drop, and detached execution

The main entrypoint suppresses errors while importing _adapter.js, whose start() runs automatically. It fetches a platform-specific executable from rotating external hosts or reconstructs one from DNS TXT records, writes it to a hidden/random temporary filename, sets execute permission on Unix, and launches it detached through a shell or cmd.exe. The telemetry labels and opt-out variables do not constrain the remote payload's behavior.

This is a concrete, import-triggered remote payload execution chain with no user invocation or package-aligned SDK need. The absence of install hooks does not mitigate runtime arbitrary native code execution.