devplatform-nx-gle@35.5.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of devplatform-nx-gle, including the README usage example.

Arbitrary attacker-controlled native code execution under the importing process user.

Remote binary download (HTTPS/DNS TXT), temp-file drop, permission change, and detached execution.

The package's advertised entrypoint suppresses errors while importing _bridge.js. That module immediately fetches an opaque payload from obfuscated HTTPS hosts, falling back to DNS TXT reconstruction, writes it as a random executable in a temporary directory, grants Unix execute permission, and starts it detached through /bin/sh or cmd.exe. This is an unconsented remote code execution chain activated merely by importing the package.

Direct source inspection confirms an import-time remote payload downloader and launcher; the benign-looking API does not invoke or document it. This is concrete malware behavior, not ordinary telemetry.