boxy-render-unwrap@35.7.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any application require/import of the package entrypoint.

Arbitrary remote code executes with the privileges of the importing Node.js process.

remote binary download, temporary-file drop, and detached execution

Loading index.js requires _bootstrap.js. Its init routine fetches a platform-selected payload from obfuscated Workers hosts or reconstructs one from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it detached through a shell or cmd.exe. The package provides no user-facing feature requiring this behavior.

The malicious chain is concrete, reachable at import time, and silently executes unverified remote bytes. No lifecycle hook is needed for this runtime compromise.