boxy-pkg-deps-hash@35.1.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node process that requires the package's declared main entrypoint.

Unconsented arbitrary native code execution under the consuming process user.

Import-time remote payload download, drop, and detached execution.

The declared main imports _adapter.js immediately. Its setup routine downloads a platform payload from hard-coded worker hosts, or reconstructs one from DNS TXT records, writes it to a hidden/temp filename, marks it executable on Unix, and starts it detached through /bin/sh or cmd.exe. A temporary analytics_state file suppresses repeated execution.

This is a concrete import-time remote code execution chain unrelated to the advertised dependency-hash API. The obfuscated endpoints, DNS payload fallback, hidden drop files, and detached execution establish malicious intent.