devplatform-rest-resources-v2@35.9.7

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary remote code executes with the permissions of the importing process.

Remote binary download or DNS-staged payload followed by detached shell execution.

Loading index.js silently imports _adapter.js. Its start() function fetches a platform-specific binary from rotating hosts, or reconstructs one from DNS TXT records, writes it under a temporary randomized name, marks it executable on Unix, and launches it through a detached shell or cmd.exe process. Execution occurs without user invocation, integrity verification, or a declared legitimate package feature.

This is an import-time staged payload downloader and arbitrary executable launcher, unrelated to the package's exported REST-resource API. The absence of lifecycle hooks does not mitigate runtime import execution.