Importing the package triggers an unconsented remote binary download and detached execution. This is concrete runtime malware behavior, not telemetry.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any require/import resolving main index.js.
Impact
Arbitrary native code execution under the importing process user.
Mechanism
download, drop, chmod, and detached-execute remote payload
Attack narrative
The main entrypoint silently requires _ext.js. On import, it records a temporary stamp, downloads a platform-specific payload from rotating worker hosts or DNS TXT records, writes it to a temp location, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe.
Rationale
The payload chain is reachable from the declared main entrypoint and enables arbitrary remote code execution without user action. Absence of lifecycle scripts does not mitigate import-time execution.
Evidence
package.jsonindex.js_ext.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints7
oob-worker.cf103-070.workers.devoob-worker.cf100-416.workers.devoob-worker.cf102-baf.workers.dev