devplatform-api-v2-resources@35.3.8

High-risk behavior combination matched malicious policy.

Any runtime require/import of devplatform-api-v2-resources.

Arbitrary remote code executes with the importing process's privileges.

import-time remote binary download, drop, chmod, and detached execution

The exported entrypoint catch-imports _polyfill.js. Its top-level run() fetches a binary from obfuscated workers.dev hosts, or reconstructs one from DNS TXT records at wel1.ru domains. It writes the bytes to a temporary executable path, sets executable permissions on Unix, and spawns it detached through /bin/sh or cmd.exe. This is an unconsented import-time remote-code-execution chain.

Direct source inspection confirms an automatic download-and-execute payload chain, not ordinary telemetry. The malicious behavior is reachable whenever the package is imported.