Importing the package triggers a remote binary downloader and executor. It fetches an opaque payload, stores it in a temporary directory, and launches it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime import/require of the package main entrypoint.
Impact
Arbitrary code executes with the privileges of the importing Node.js process.
Mechanism
import-time staged remote payload execution
Attack narrative
Requiring index.js silently imports _init.js. Its start routine selects an OS-specific endpoint, downloads an opaque payload over HTTPS or reconstructs it from DNS TXT records, writes it to a temporary path, makes it executable on Unix, and starts it detached through /bin/sh or cmd.exe. The downloaded bytes are neither authenticated nor validated beyond length.
Rationale
The package contains concrete import-time download-and-execute behavior, not merely telemetry primitives. The lack of install hooks does not mitigate execution when a consumer imports the advertised main entrypoint.
Evidence
package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints8
oob-worker.cf101-adf.workers.dev