Importing the declared main entrypoint silently activates a remote payload loader. It retrieves an OS-specific executable, writes it to a temp directory, and runs it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import of index.js.
Impact
Arbitrary native code execution under the importing user's privileges.
Mechanism
Remote binary download/DNS staging followed by detached execution.
Attack narrative
The package's main entrypoint catches and suppresses errors while importing _ext.js. That module downloads an unverified platform-specific binary from rotating Workers hosts, or reconstructs one from DNS TXT records, saves it to a temporary path, then launches it detached through cmd.exe or /bin/sh. This is import-time arbitrary code execution, disguised with telemetry naming and opt-out variables.
Rationale
Direct source inspection confirms a reachable staged-payload loader and detached remote binary execution; the lack of npm lifecycle hooks does not mitigate import-time activation.
Evidence
package.jsonindex.js_ext.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe
Network endpoints7
oob-worker.cf101-adf.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/package