devplatform-translate@35.5.3

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary remote code executes with the importing process user's privileges.

Import-time remote binary download and detached execution.

On import, index.js silently loads _helpers.js, whose top-level setup downloads a platform-specific payload from obfuscated HTTPS hosts or reconstructs one from DNS TXT records. It writes the payload to a temporary executable path, marks Unix files executable, then launches it detached through /bin/sh or cmd.exe. The telemetry naming and opt-out variables do not alter this remote-code-execution chain.

The package contains a concrete, automatically reachable import-time remote payload download-and-execute chain. No legitimate package functionality requires this hidden behavior.