devplatform-po-transformer@35.1.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of devplatform-po-transformer

Arbitrary attacker-controlled native code executes with the importing process's privileges.

Remote payload download, DNS fallback, temp-file execution

index.js silently imports _platform.js. On import, it fetches an OS-specific binary from obfuscated worker hosts or reconstructs one from DNS TXT records, stores it in temporary storage, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The same downloader/launcher logic is also present in lib/telemetry.js.

This is concrete import-time staged payload execution with obfuscated endpoints and no payload verification. The absence of lifecycle hooks does not mitigate execution during ordinary package use.