boxy-global-modules-webpack-plugin@35.5.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js

Arbitrary remote code execution in the importing user's environment.

remote payload download, temporary drop, and detached execution

The package's normal import path silently loads _loader.js. That loader selects a platform payload, retrieves it from hard-coded HTTPS hosts or DNS TXT records, writes it to a temporary executable path, changes permissions on Unix, and starts it detached through a shell or cmd.exe. This is a concrete remote-code-execution chain, not normal webpack-plugin behavior.

The import-time loader provides a direct, obfuscated download-and-execute chain with no user opt-in. Absence of lifecycle hooks does not mitigate execution when consumers import the declared entrypoint.