Importing the package silently starts a remote payload loader. It retrieves an opaque binary, drops it to a temp directory, and runs it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import of index.js.
Impact
Arbitrary code execution under the importing process user.
Mechanism
Remote binary download/DNS payload staging followed by detached execution.
Attack narrative
On ordinary import, index.js loads _init.js. That module fetches a platform-specific opaque payload from rotating HTTPS hosts or DNS TXT records, writes it to a temporary executable file, marks it executable on Unix, and starts it detached through a shell or cmd.exe. The marker and suppressed errors reduce visibility and rate-limit repeat execution.
Rationale
This is a concrete import-time staged-payload execution chain unrelated to the advertised SDK, with no integrity validation or explicit user action.
Evidence
package.jsonindex.js_init.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints8
oob-worker.cf99-9b3.workers.devoob-worker.cf101-adf.workers.devoob-worker.cf103-070.workers.dev