devplatform-integrations-tests-lib@35.2.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import of the package entrypoint.

Arbitrary remote code execution in the importing user's environment.

Import-time staged payload download, drop, chmod, and detached execution.

The public entrypoint silently requires _bootstrap.js. On import, it selects a platform payload, downloads it from rotating workers.dev hosts or reconstructs it from DNS TXT records, writes it to a temporary executable path, and launches it detached via shell or cmd.exe. The package's stated testing/mock purpose does not require this behavior.

Concrete import-time remote payload execution is present in source, with no user opt-in or legitimate package-aligned purpose. This is malware, not merely telemetry.