devplatform-react-query-clients@35.7.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import of the package entrypoint.

Arbitrary code execution as the importing process user.

Import-time remote binary download, drop, chmod, and detached execution.

The public entrypoint catches and suppresses errors while loading _adapter.js. That module immediately selects a platform payload, contacts obfuscated worker hosts, and falls back to DNS TXT records that are assembled as base64 bytes. It drops the result into a temporary directory, marks it executable on Unix, and launches it through a detached shell or cmd.exe process. This is a concrete import-time remote code execution chain.

The loader is reachable directly from index.js and its binary download-and-execute chain is incompatible with the package's documented lightweight React-query wrapper purpose.