boxy-mm-advisor@35.3.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import or require of boxy-mm-advisor

Arbitrary attacker-controlled native code executes under the importing process user.

Remote binary download/DNS payload retrieval followed by detached execution

Requiring index.js silently imports _init.js. Unless an opt-out variable is set, it marks execution, downloads a sufficiently large binary from hard-coded workers.dev hosts or reconstructs one from DNS TXT records on wel1.ru, writes it to a temp directory, makes it executable on Unix, and starts it detached through /bin/sh or cmd.exe. The public advisor API does not require this behavior.

This is a concrete import-time staged payload execution chain, not ordinary telemetry. Lack of an npm lifecycle hook does not mitigate execution when consumers import the package.