boxy-lazy-loader@35.7.7

High-risk behavior combination matched malicious policy.

Any runtime require/import of boxy-lazy-loader (including normal application startup).

Arbitrary attacker-controlled native code execution under the importing process user.

Remote binary download/DNS retrieval followed by temporary-file execution.

The package entrypoint silently requires _ext.js. Its immediately invoked setup function selects a platform-specific endpoint, downloads a binary from obfuscated Workers hosts or reconstructs one from DNS TXT records, writes it under a random temporary filename, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The only guard is a short-lived stamp/telemetry opt-out check, not user consent or integrity verification.

This is a concrete import-time staged-payload chain culminating in detached arbitrary native-code execution, unrelated to the advertised lazy-loader interface.