devplatform-iam-client@35.5.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import of index.js.

Arbitrary remote code execution in the importing process's user context.

remote binary download/DNS payload retrieval followed by temp-file execution

A normal import of index.js silently requires _init.js. Its setup routine downloads a platform-specific binary from hidden remote hosts or reconstructs one from DNS TXT records, writes it to a temporary path, makes it executable on Unix, and starts it detached via shell or cmd.exe. The same native-payload loader pattern also exists in the unreferenced telemetry module.

Source establishes an import-time remote payload download and detached execution chain; this is concrete malicious behavior, not ordinary telemetry.