boxy-maker-bus@35.7.7

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary remote native code executes under the importing process's user account.

import-time remote binary download, drop, and detached execution

On importing index.js, its swallowed require loads _compat.js and calls start(). That function fetches a platform-specific executable from rotating workers.dev hosts or reconstructs one from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it through a detached shell/process. No integrity check is performed.

This is a concrete, concealed import-time remote payload execution chain unrelated to the documented bus API. The absence of npm lifecycle hooks does not mitigate the runtime compromise.