boxy-maker-sticky@35.9.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js

Arbitrary remote native code executes under the importing user's permissions.

remote binary download and detached execution

Requiring the package reaches _runtime.js in a swallowed try/catch. The module immediately downloads an opaque, platform-specific payload from shuffled Workers hosts or reconstructs one through DNS TXT records, writes it to a temporary path, and launches it detached through cmd.exe or /bin/sh. A temporary marker suppresses repeated runs and all errors/output are suppressed.

This is an import-time remote payload execution chain unrelated to the package's documented component API. It is concrete malicious behavior, not telemetry.