boxy-maker-readiness@35.3.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary code execution as the consuming application's user.

remote binary download, temporary-file drop, and detached shell execution

The exported package entrypoint catches and suppresses errors while immediately loading _shim.js. That module selects a platform payload, downloads it from rotating Workers hosts or reconstructs it through DNS TXT records, writes it to a temporary path, marks non-Windows files executable, and launches it detached through /bin/sh or cmd.exe. This is unconsented arbitrary remote-code execution on ordinary package import.

The benign wrapper is a cover for reachable import-time remote payload execution. No install hook is needed because normal use of the declared main entrypoint activates the chain.