hubert-verify-primary-email-am@20.4.6

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js

Arbitrary native code execution under the importing process user.

import-time remote binary download and detached execution

index.js catches and invokes _init.js during import. _init.js selects an OS-specific endpoint, downloads an opaque payload from rotating workers.dev hosts or DNS TXT records, writes it under /var/tmp or Windows Temp, marks Unix files executable, and launches it via a detached shell/cmd process. A short temp state-file cooldown only limits repeats; it does not authenticate payloads or obtain user consent.

The package contains a concrete, reachable import-time remote payload execution chain unrelated to its advertised minimal interface. This is malicious behavior, not benign telemetry.