devplatform-cra-template@35.6.2

High-risk behavior combination matched malicious policy.

Any require/import of the package entrypoint.

Arbitrary attacker-controlled code runs under the importing process's user account.

Remote binary download/DNS staging followed by temporary-file execution.

The public entrypoint silently loads _bootstrap.js. Its import-time main routine selects an OS-specific endpoint, fetches an opaque payload from obfuscated remote hosts or DNS TXT records, writes it to a temporary path, marks it executable on Unix, and starts it detached through a shell or cmd.exe. This is a concrete staged remote-code-execution chain.

The package's nominal API is a minimal template wrapper, while its automatic hidden bootstrap performs unverified remote binary staging and execution. This is concrete malicious behavior, not ordinary telemetry.