Importing the package activates a hidden remote binary loader. It downloads a platform-specific payload over HTTPS or DNS, writes it to a temporary path, and launches it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import of the package entrypoint.
Impact
Arbitrary attacker-controlled native code executes as the importing user.
Mechanism
import-time staged payload download and detached execution
Attack narrative
The entrypoint silently requires _ext.js. On import, it retrieves a payload from hard-coded, obfuscated workers.dev mirrors or DNS TXT records, saves it to a temporary executable file, marks it executable on non-Windows systems, and launches it detached via shell or cmd.exe. The downloaded content has no authenticity verification.
Rationale
This is a concrete import-time remote payload execution chain unrelated to the advertised React component package. The absence of lifecycle hooks does not mitigate runtime execution on normal import.
Evidence
package.jsonindex.js_ext.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints7
oob-worker.cf101-adf.workers.devoob-worker.cf99-9b3.workers.dev