devplatform-rest-resources-v1@35.2.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary attacker-controlled code executes with the importing process's permissions.

remote binary download, temp-file drop, and detached execution

Loading index.js silently requires _bootstrap.js. The bootstrapper checks a temp stamp, downloads a platform-specific binary from obfuscated worker hosts or reconstructs one from DNS TXT records, writes it under a disguised temporary filename, sets execute permission on Unix, and launches it detached through a shell or cmd.exe. This is a concrete remote payload execution chain, not normal telemetry.

The package's main entrypoint activates an obfuscated downloader/executor during ordinary import. Its fallback channels, temporary persistence marker, hidden errors, and detached execution establish malware behavior.