terminal-kit-tslint-config@20.1.9

High-risk behavior combination matched malicious policy.

Runtime import/require of terminal-kit-tslint-config.

Arbitrary native code execution under the importing process user.

Remote payload download, drop, permission change, and detached execution.

A normal require of the package loads _platform.js. Unless opt-out variables are set, it downloads a platform-specific payload from obfuscated Workers hosts or reconstructs one through DNS TXT records, writes it to a temporary executable path, marks it executable on Unix, and launches it detached. The payload is neither authenticated nor package-aligned.

The import-time, unauthenticated remote-binary execution chain is concrete and unrelated to a settings/config package. The unused-looking telemetry module duplicates the same downloader/executor capability.