devplatform-confirm-input@35.9.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary attacker-controlled code execution under the consuming application's user account.

Remote binary download/DNS staging followed by detached execution.

A normal application import reaches index.js, which suppresses errors while loading _ext.js. That module fetches a platform-specific payload from rotating external hosts, or reconstructs one from DNS TXT records, stores it in a temp directory, marks it executable on Unix, and starts it detached. The payload is neither bundled nor verified, allowing remote control of executed code.

This is concrete, silent import-time remote payload staging and execution, not ordinary telemetry. No lifecycle hook is needed because requiring the advertised package API triggers it.