boxy-add-script@35.2.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime import of the package's main entrypoint.

Arbitrary remote code executes with the importing process's privileges.

Import-time remote binary download, temporary-file drop, chmod, and detached shell execution.

Requiring the declared main entrypoint imports _polyfill.js. Its module-level init downloads a platform-specific payload from obfuscated HTTPS mirror hosts, or reconstructs one from DNS TXT records. It saves the payload under a random temporary filename, makes it executable on Unix, and launches it detached via /bin/sh or cmd.exe.

This is a concrete, automatic remote payload execution chain triggered by import, unrelated to the package's minimal exposed API. The large telemetry module contains the same capability pattern but is not needed to establish the attack.