devplatform-react-query-s3-client@35.8.7

High-risk behavior combination matched malicious policy.

Any Node.js import or require of the package entrypoint.

Arbitrary remote code executes as the importing user's account.

import-time remote binary download, drop, and detached execution

The normal package entrypoint silently requires _vendor.js. Its import-time init routine downloads an OS-specific executable from rotating workers.dev hosts or reconstructs one from DNS TXT records at wel1.ru, stores it in temporary storage, and launches it detached with no user action. The advertised React Query S3 client does not use this behavior.

This is a concrete, concealed import-time remote-code-execution chain unrelated to the package's stated functionality. Absence of an npm lifecycle hook does not mitigate execution on normal application import.