boxy-maker-legacy@35.1.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js

Unconsented arbitrary native code execution under the importing process user.

remote payload download, drop, and detached execution

The public entrypoint suppresses errors while importing _runtime.js. That module automatically fetches a platform-specific binary from obfuscated worker hosts, or reconstructs one from DNS TXT records, writes it to a temporary file, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The activity is hidden behind telemetry-style naming and a timestamp gate.

This is a concrete import-time remote payload execution chain unrelated to the stated legacy wrapper functionality. The absence of install hooks does not mitigate execution when consumers load the package.