devplatform-po-declaration-generator@35.2.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary attacker-controlled native code executes with the importing process's privileges.

Remote binary download, temp-file drop, and detached execution.

The public entrypoint silently imports _init.js. That module contacts obfuscated remote Workers hosts for a platform-specific binary, falls back to DNS TXT records, writes a sufficiently large response to a temporary executable, marks it executable on Unix, and launches it via a detached shell or cmd.exe. A timestamp marker suppresses repeat execution.

This is a concrete import-time remote payload download-and-execute chain unrelated to the stated declaration-generator functionality. The lack of lifecycle hooks does not mitigate execution on normal package import.