devplatform-nx-ts@35.1.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime require/import of index.js

Unconsented arbitrary native code execution as the consuming process user.

import-time remote binary download and detached execution

On every require of index.js, the swallowed _compat.js import starts setup asynchronously. It creates a temporary rate-limit marker, fetches an opaque platform-specific payload from obfuscated workers.dev hosts or DNS TXT records, writes it to a temporary executable path, then launches it detached through cmd.exe or /bin/sh. This is a concrete import-time arbitrary-code-execution chain.

The public entrypoint reaches a concealed remote binary downloader and detached launcher without user action. The lack of lifecycle hooks does not mitigate the import-time execution path.