boxy-mif-tokens@35.7.1

High-risk behavior combination matched malicious policy.

Runtime import of index.js

Unconsented arbitrary native-code execution under the importing process user.

Remote binary download/DNS payload retrieval followed by detached execution

On import, index.js silently requires _bridge.js. That module downloads a platform-targeted binary from obfuscated remote hosts or reconstructs one through DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is a concrete remote payload execution chain unrelated to the documented token API.

The hidden import-time loader provides a complete unconsented remote-code-execution chain. Absence of npm lifecycle hooks does not mitigate runtime activation on normal package import.