devplatform-api-v2-resource-mock@35.4.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of devplatform-api-v2-resource-mock

Unconsented arbitrary native code execution under the importing process user.

remote binary download, DNS fallback, temporary-file drop, detached shell execution

The package entrypoint silently requires _compat.js on every import. That module selects a platform payload path, fetches opaque bytes from rotating workers.dev hosts, or reconstructs them from DNS TXT records, writes the bytes to a temporary executable file, and launches it detached via cmd.exe or /bin/sh. The marker file and opt-out telemetry names obscure and throttle this execution.

This is a concrete import-time remote payload execution chain unrelated to the declared mock REST-client functionality. The absence of lifecycle hooks does not mitigate execution on normal package use.