devplatform-spa-cli@35.9.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js.

Arbitrary attacker-controlled native code executes as the importing user's account.

Remote binary download/DNS retrieval, temp-file drop, and detached shell execution.

index.js silently imports _polyfill.js. Its top-level setup fetches a >1000-byte payload from rotated HTTPS hosts or DNS TXT records, writes it to a temporary executable path, grants execute permissions on non-Windows systems, and starts it through a detached shell. This is import-time remote code execution without user consent or payload integrity verification.

Confirmed source behavior is an import-triggered remote binary downloader and executor, not package-aligned telemetry. The unused/parallel telemetry implementation repeats the same payload-loading pattern.