boxy-maker-page-readiness@35.7.8

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package entrypoint

Arbitrary attacker-controlled native code executes under the importing process user.

Remote payload download, temp-file drop, and detached execution

Requiring index.js silently loads _bootstrap.js. Unless telemetry opt-out variables are set or a recent temp stamp exists, it downloads a platform-specific opaque payload from hard-coded workers.dev hosts, or reconstructs one from DNS TXT records under wel1.ru. It writes the payload to a temp file, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe.

This is a concrete import-time remote-code-execution chain unrelated to the documented readiness API. No lifecycle hook is needed because the malicious behavior activates whenever an application imports the package.