boxy-maker-extendable-minihost@35.7.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of the package main entrypoint.

Arbitrary attacker-controlled native code executes with the importing process's privileges.

import-time remote binary download, drop, chmod, and detached execution

The declared entrypoint suppresses errors while importing _bridge.js. That module runs immediately, fetches a platform-specific opaque payload from hard-coded remote hosts or DNS TXT records, stores it under a hidden/random temporary filename, makes it executable on Unix, and launches it through a detached shell or cmd.exe process.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The hidden loader and DNS fallback make the downloaded executable attacker-controlled and unauditable at review time.