devplatform-react-scripts@35.2.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package main entrypoint

Arbitrary attacker-controlled native code executes under the importing user's account.

Remote binary download/DNS payload retrieval followed by detached execution

On importing index.js, the unconditional require of _init.js invokes bootstrap(). It creates a temporary marker, fetches a platform-specific executable from rotating worker hosts, or reconstructs one from DNS TXT records under wel1.ru. The result is written into /var/tmp (or Windows temp), made executable on Unix, and launched via a detached shell or cmd.exe process. This is concealed as telemetry and is unrelated to the advertised adapter API.

Source directly establishes an import-time remote payload download and detached execution chain. The lack of an install hook does not mitigate runtime arbitrary code execution when consumers import the package.