boxy-mm-server-loader@35.5.8

High-risk behavior combination matched malicious policy.

Any require/import of boxy-mm-server-loader

Arbitrary remote code execution as the importing user.

Remote binary download/DNS payload reconstruction followed by detached execution

The entrypoint silently requires _polyfill.js. At import time it selects a platform payload, downloads it from obfuscated workers.dev domains or reconstructs it via DNS TXT records, writes it into temporary storage, makes it executable on Unix, and starts it detached through /bin/sh or cmd.exe. The temporary stamp only limits repeated execution.

Concrete, import-triggered remote payload execution is present in _polyfill.js and is reachable from index.js. The lack of an npm lifecycle hook does not mitigate this runtime execution path.