devplatform-api-v2-endpoint@35.6.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime require/import of devplatform-api-v2-endpoint

Arbitrary native code execution under the importing user's privileges.

Remote binary download with DNS fallback and detached execution

The normal module entrypoint catches and suppresses errors while requiring _vendor.js. That file marks a temp state file, retrieves a payload from rotated workers.dev hosts or DNS TXT records, writes it as a randomly named executable in a temp directory, makes it executable on Unix, and launches it detached through a shell or cmd.exe. This is an unconsented runtime remote-code-execution chain.

Source inspection confirms an import-time staged payload downloader and executor, not ordinary telemetry. No lifecycle hook is needed because index.js activates it on normal use.