devplatform-po-loader@35.1.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of devplatform-po-loader

Arbitrary code execution under the importing process user.

remote binary download, temp-file drop, and detached execution

Requiring the declared main entrypoint loads _platform.js. That module fetches a platform-specific payload from obfuscated remote hosts, with DNS TXT records as a fallback, writes it to a temporary path, makes it executable on Unix, and starts it through a detached shell or cmd.exe process. Its marker only limits repeat execution; it does not require explicit user setup.

The import-time loader establishes a concrete remote-payload execution chain. The unused telemetry module contains materially similar downloader/executor logic, reinforcing intent.