boxy-maker-wave@35.2.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary remote code executes with the importing process's privileges.

remote binary download, drop, and detached execution

Requiring index.js silently imports _platform.js, which runs main() immediately. The loader selects a platform payload path, retrieves bytes from rotating Workers hosts or DNS TXT records, saves the result in a temporary directory, applies executable permissions on Unix, and starts it detached through a shell or cmd.exe. lib/telemetry.js contains a matching remote-extension download-and-execute mechanism.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate execution triggered by importing the documented package entrypoint.