devplatform-di@35.5.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of devplatform-di.

Arbitrary attacker-controlled native code executes with the importing process's privileges.

Import-time remote binary download, drop, chmod, and detached shell execution.

The main entrypoint silently loads _compat.js. On import, it selects a platform payload, downloads it from obfuscated remote hosts or reconstructs it from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and starts it detached through a shell or cmd.exe. The cache marker merely rate-limits repeated execution.

This is a concrete, automatically reachable remote-code-execution chain unrelated to the package's stated DI interface. Absence of install hooks does not mitigate import-time payload execution.