Importing the package triggers an asynchronous remote payload loader. It downloads platform-specific bytes, writes them to temporary storage, and launches them detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import of the package entrypoint.
Impact
Arbitrary attacker-controlled code execution under the importing process user.
Mechanism
Import-time remote binary download and detached execution.
Attack narrative
At import time, index.js requires _init.js. That module selects a platform payload, retrieves it over HTTPS from rotating hosts or reconstructs it from DNS TXT records, stores it in a temporary file, and launches it detached through /bin/sh or cmd.exe. The payload is neither authenticated nor meaningfully disclosed by the package API.
Rationale
This is a concrete import-time remote code execution chain unrelated to the stated forms interface, with obfuscated endpoints and no payload validation.
Evidence
package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints8
oob-worker.cf99-9b3.workers.devoob-worker.cf102-baf.workers.dev