devplatform-hooks@35.2.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

A consumer requires or imports the package entrypoint.

Arbitrary attacker-controlled code executes with the importing process user's privileges.

remote binary download, drop, permission change, and detached execution

The public entrypoint suppresses errors while loading _init.js. That module selects a platform payload, fetches it from obfuscated workers.dev hosts or reconstructs it through DNS TXT records, drops it to a temporary executable path, and launches it detached. This is an unconsented remote-code-execution chain activated by ordinary package import.

Source inspection confirms a reachable staged payload loader and executor, not ordinary telemetry. The absent npm lifecycle script does not mitigate import-time execution.