digital-interview-digital-interview-core@20.5.3

High-risk behavior combination matched malicious policy.

require/import of index.js

Arbitrary remote code executes under the importing user's privileges.

remote binary download, temporary-file drop, detached execution

On ordinary package import, index.js silently loads _helpers.js. That helper fetches a platform-specific opaque payload from obfuscated worker hosts, or reconstructs it from DNS TXT records, saves it to a temporary executable path, and launches it detached via cmd.exe or /bin/sh. This is unauthenticated remote code execution, not telemetry.

The malicious chain is import-reachable and independently confirmed in source. The lack of lifecycle hooks does not mitigate automatic runtime execution.