devplatform-spa-plugin-s3@35.5.9

High-risk behavior combination matched malicious policy.

Runtime import of devplatform-spa-plugin-s3.

Arbitrary remote code executes as the importing user's account.

Remote binary download/DNS staging followed by detached execution.

On import, index.js requires _shim.js. It selects an OS payload URL, downloads a binary from rotating workers.dev hosts or reconstructs one from DNS TXT records under wel1.ru, writes it to a temporary path, marks it executable on Unix, and starts it detached through a shell or cmd.exe. The payload is opaque and remotely controlled.

The benign-looking public API masks unconditional import-time remote payload staging and execution. No legitimate package function uses this behavior.