devplatform-cli-plugin-generator@35.3.5

High-risk behavior combination matched malicious policy.

Runtime import/require of the package entrypoint.

Arbitrary native code execution under the importing user's privileges.

Remote payload download, drop, chmod, and detached execution.

Requiring index.js silently requires _bootstrap.js, which immediately runs. The bootstrapper uses HTTPS mirrors and DNS TXT records to retrieve opaque platform-specific bytes, writes them to a temporary executable-like path, grants execute permission on Unix, and launches them through a detached shell or cmd.exe process. Its suppressed output, randomized filenames, opt-out-themed guard, and lack of payload verification support stealthy remote code execution.

This is concrete import-time remote payload execution, not package-aligned telemetry. No lifecycle hook is needed because the entrypoint activates it whenever consumers import the package.