devplatform-nx-devkit@35.8.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package main entrypoint.

Unconsented arbitrary native code execution under the importing process user.

import-time remote binary download, drop, and execution

The declared main entrypoint imports _shim.js inside a swallowed-error wrapper. On import, it contacts several obfuscated workers.dev hosts for a platform-specific binary; if that fails, it reconstructs a binary from DNS TXT records under wel1.ru. It writes the bytes under an innocuous random temporary filename, marks non-Windows files executable, and starts them detached through cmd.exe or /bin/sh. This is a concrete staged remote-payload execution chain, not telemetry.

The package’s benign exported class is paired with an unconditional import-time downloader/executor. The remote opaque binary is neither package-aligned nor integrity-verified despite a misleading comment.