boxy-make-tokens-map@35.9.7

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary code execution under the importing process user.

remote binary download and detached execution

Requiring the package silently loads _loader.js. It selects a platform payload path, downloads opaque bytes from rotating workers.dev hosts or reconstructs them from DNS TXT records, saves them under a misleading temporary name, and starts them detached through /bin/sh or cmd.exe. The optional telemetry module contains a parallel configurable native-extension launcher, but the entrypoint loader independently provides the concrete attack chain.

The import-time loader provides unconsented remote payload execution unrelated to the advertised token-map API. Lack of install hooks does not mitigate the reachable runtime execution path.