boxy-fixture-allure@20.8.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of boxy-fixture-allure.

Arbitrary native code execution under the importing user's privileges.

Obfuscated remote payload download, drop, chmod, and detached execution.

A normal require of index.js silently loads _shim.js. Unless opt-out variables are set, it obtains a platform payload from obfuscated worker hosts or DNS TXT records, writes it under a deceptive temporary filename, makes it executable on Unix, and launches it through a detached shell or cmd.exe process. The downloaded bytes are neither authenticated nor tied to the advertised fixture API.

The import-time loader implements concrete, unauthenticated remote binary execution. This is malicious behavior independent of the lack of npm lifecycle hooks.