fb-cards-form-no-resident-information@20.4.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary code execution under the importing process's user account.

Remote binary download/DNS staging followed by detached execution.

The main entrypoint silently imports _adapter.js. On import, it fetches a platform-specific binary from obfuscated HTTPS hosts or reconstructs it from DNS TXT records, saves it to a temporary directory, marks it executable on Unix, and launches it detached via shell/cmd.

This is concrete import-time staged payload execution, not package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution whenever consumers import the package.