devplatform-http-client@35.8.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Unconsented remote code execution with the importing process's privileges.

automatic remote binary download, drop, chmod, and detached execution

Requiring index.js silently requires _vendor.js. Its import-time init selects an OS-specific URL, fetches a payload from hard-coded worker hosts or reconstructs it from DNS TXT records, writes it to a temporary executable path, grants execute permission on Unix, and starts it detached through a shell or cmd.exe. Failures are suppressed and a temporary timestamp suppresses repeated attempts.

The package's advertised HTTP wrapper has an import-time, concealed remote binary execution chain unrelated to its stated function. This is concrete malware behavior, not merely telemetry.