devplatform-nx-pvm@35.2.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime require/import of index.js

Arbitrary attacker-controlled code execution under the consuming application's user account.

Remote payload download, temporary-file drop, chmod, and detached shell execution

The public entrypoint catches and suppresses an import of _compat.js, whose top-level init runs immediately. It downloads a platform-specific binary from rotating worker hosts, with DNS TXT/base64 retrieval as fallback, saves it under a benign temporary name, makes it executable on Unix, and starts it detached through a shell or cmd.exe. This is unconsented remote code execution unrelated to the package’s stated abstraction API.

Direct source inspection confirms an import-time staged-payload loader with silent detached execution. The absence of an npm lifecycle hook does not mitigate the reachable runtime attack.