Importing the package triggers a hidden remote-binary loader. It downloads an unverified platform payload, drops it into a temp directory, and launches it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import of the package entrypoint.
Impact
Arbitrary remote code executes with the permissions of the importing Node process.
Mechanism
import-time staged payload download, drop, and execution
Attack narrative
At package import, index.js loads _init.js. The initializer selects a platform payload path, retrieves binary data from rotating Workers hosts or DNS TXT records, writes it to a temporary file, makes Unix payloads executable, and starts it detached through a shell or cmd.exe. The payload is unverified and attacker-controlled by the remote endpoint.
Rationale
The package's declared icon/adapter behavior does not justify hidden import-time remote binary execution. The directly inspected loader establishes a concrete staged-malware chain.
Evidence
package.jsonindex.js_init.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe
Network endpoints7
oob-worker.cf103-070.workers.devoob-worker.cf99-9b3.workers.dev