boxy-legacy-providers@35.6.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Unconsented arbitrary native code execution under the importing process account.

Remote binary download/DNS staging followed by detached execution.

index.js suppresses errors while requiring _shim.js, whose top-level main() runs on import. The shim selects a platform payload path, retrieves a binary from obfuscated workers.dev hosts, or reconstructs one from DNS TXT records under dl.wel1.ru. A payload over 1000 bytes is written under a random temporary name, marked executable on Unix, and launched through a detached shell or cmd.exe process. The downloaded content has no enforced hash or signature validation.

This is a concrete import-time staged-payload chain, not package-aligned telemetry. It enables arbitrary remote code execution without user action.