boxy-micro-story@35.4.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

require('boxy-micro-story') / loading index.js

Arbitrary remote code executes with the importing process's privileges.

remote binary retrieval, temporary drop, and detached shell execution

index.js suppresses errors while importing _platform.js. On import, it records a temporary marker, retrieves a platform-specific binary from obfuscated HTTPS mirrors or DNS TXT records, writes it under a temporary cache-like name, makes it executable on Unix, and launches it detached through a shell or cmd.exe.

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of a lifecycle hook does not mitigate the automatic require-time execution.