Importing the package's declared main entrypoint automatically starts a remote payload loader. It retrieves a binary over HTTPS or DNS TXT, drops it to a temp directory, and executes it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any require/import of index.js during application runtime.
Impact
Unconsented arbitrary native code execution under the importing process account.
Mechanism
Automatic remote binary download, drop, and detached execution.
Attack narrative
On import, index.js silently requires _init.js. Its setup routine obtains a platform-specific payload from rotating HTTPS hosts, or reconstructs one from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The marker only rate-limits repeat execution.
Rationale
This is a concrete, automatically triggered remote payload execution chain unrelated to the package's stated minimal library API. Opt-out environment checks do not establish informed user consent.
Evidence
package.jsonindex.js_init.js/tmp/.analytics_state/var/tmp/.cache_<random>
Network endpoints8
oob-worker.cf102-baf.workers.devoob-worker.cf103-070.workers.devoob-worker.cf99-9b3.workers.dev