devplatform-prettier-config@35.1.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of devplatform-prettier-config.

Unconsented arbitrary native code execution in the importing user's environment.

Remote binary retrieval, temporary-file drop, permission change, and detached shell execution.

Importing index.js invokes _compat.js. Its setup routine obtains a platform-specific binary over HTTPS from obfuscated worker hosts or reconstructs it from DNS TXT records, stores it under a temporary disguised filename, makes it executable on Unix, and launches it detached via /bin/sh or cmd.exe. The telemetry module contains the same download-and-execute primitive, supporting deliberate payload functionality rather than a prettier configuration package.

The documented package role is a configuration loader, but its import path immediately performs covert remote native payload execution. This is concrete malware behavior, not a benign telemetry primitive.