devplatform-cli-plugin-test@35.4.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

A consumer requires or imports the package main entrypoint (index.js).

Arbitrary attacker-supplied native code executes as the application user.

obfuscated HTTPS/DNS payload download, temp-file drop, and detached execution

The public entrypoint silently requires _runtime.js. At import time it selects an OS payload path, retrieves bytes from rotated obfuscated Workers hosts or DNS TXT records, writes a cache marker and a random executable in a temporary directory, marks it executable on Unix, and launches it through a detached shell or cmd.exe process. The claimed integrity check is absent.

This is concrete automatic remote payload execution on package import, unrelated to the documented test-harness functionality. It is malicious regardless of the absence of npm lifecycle hooks.