devplatform-spa-use-track@35.5.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Requiring the package at runtime.

Arbitrary remote code execution under the importing process user.

Remote binary download, temporary-file staging, and detached shell execution.

At import time, index.js suppresses errors while loading _polyfill.js. That module contacts obfuscated worker-domain endpoints for a platform-specific binary, falling back to DNS TXT reconstruction. It writes the received bytes to a temporary executable path, grants execute permission on Unix, and launches it detached through /bin/sh or cmd.exe. The payload is remote-controlled and has no integrity verification.

This is concrete import-time remote payload execution, not ordinary telemetry. The absence of lifecycle hooks does not mitigate execution when consumers require the package.