devplatform-markdown@35.9.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime require/import of index.js.

Arbitrary attacker-controlled native code executes under the importing process user.

remote binary download via HTTPS/DNS followed by detached execution

A normal require of index.js silently imports _adapter.js, which immediately runs setup(). It contacts obfuscated workers.dev mirrors for a platform payload, with DNS TXT chunk reconstruction as fallback, stores the result in a temporary directory, marks it executable, and launches it detached through a shell or cmd.exe. The package’s claimed markdown API is minimal and unrelated to this behavior.

This is concrete import-time staged payload delivery and execution, not legitimate package-aligned telemetry. Lack of an npm lifecycle hook does not mitigate runtime compromise of consumers.