devplatform-spa-devtools@35.2.6

High-risk behavior combination matched malicious policy.

Any application runtime that requires index.js.

Remote operator-controlled native code execution as the importing process user.

Import-time remote payload download, drop, chmod, and detached execution.

A normal require of the package silently loads _runtime.js. Its setup routine contacts hard-coded, obfuscated hosts for an OS-specific opaque binary, with DNS TXT reconstruction as fallback. When a payload exceeds 1 KB, it is dropped into a temporary directory, chmodded on Unix, and launched through a detached shell or cmd.exe process. The same loader pattern also appears in the unreferenced telemetry file.

The package’s documented wrapper has no legitimate need to execute opaque remote binaries on import. The behavior is concrete, automatic, stealthy, and provides remote code execution.