devplatform-jscodeshift-plugin@35.4.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary attacker-controlled native code executes under the importing user's privileges.

Import-time remote binary download, drop, permission change, and detached execution.

The benign-looking entrypoint silently requires _loader.js. At import time it downloads a platform-specific opaque payload from obfuscated Cloudflare hosts or assembles one from DNS TXT records, saves it in a temp directory, makes it executable on Unix, and launches it detached via shell or cmd.exe. This is a concrete remote-code-execution chain unrelated to the documented adapter API.

Source inspection confirms an automatic, obfuscated download-and-execute chain reachable on normal import. The lack of an install hook does not mitigate import-time arbitrary payload execution.