devplatform-spa@35.1.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of devplatform-spa

Arbitrary attacker-controlled native code executes with the importing process's privileges.

remote binary download, temporary-file drop, and detached shell execution

index.js loads _loader.js whenever the package is imported. The loader contacts shuffled Workers hosts for an OS-specific payload, with DNS TXT reconstruction as a fallback; it then writes the received bytes to a temporary file, marks Unix files executable, and launches them in a detached hidden process. This is an import-time remote-code-execution chain.

The package contains a concrete, stealthy import-time downloader and executor of remote native payloads. The absence of an npm lifecycle hook does not mitigate runtime compromise when consumers import the declared main entrypoint.