devplatform-snarkdown@35.2.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js, unless telemetry opt-out environment variables are set.

Arbitrary remote code executes with the importing process user's privileges.

import-time download, drop, and detached execution of remote binary payloads

The public entrypoint suppresses errors while importing _shim.js. That module immediately contacts rotating Worker hosts for a platform-specific payload, or reconstructs one from DNS TXT records, stores it under a disguised temporary filename, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The payload is not authenticated.

This is concrete import-time remote code execution, not package-aligned telemetry. The unused telemetry file contains a similar downloader pattern but does not mitigate the active _shim.js chain.