boxy-mmb-types@35.4.1

High-risk behavior combination matched malicious policy.

Runtime import/require of boxy-mmb-types.

Arbitrary attacker-controlled native code can execute under the importing process's user account.

remote payload download, disk drop, and detached execution

A normal require of index.js silently requires _loader.js. The loader fetches a platform-specific binary from obfuscated Workers hosts, or reconstructs it from DNS TXT records, writes it to a temporary path, makes non-Windows payloads executable, and launches it via a detached shell or cmd.exe process. The payload is not authenticated despite a misleading integrity-check comment.

The import-triggered, unauthenticated download-and-execute chain is concrete remote code execution behavior and unrelated to the advertised type wrapper.