boxy-scroll-providers@35.5.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import of index.js.

Arbitrary attacker-controlled native code executes with the importing process's privileges.

remote binary download/DNS staging followed by detached execution

At import time, index.js silently requires _bootstrap.js. That module downloads a platform-specific opaque binary from rotating workers.dev mirrors or reconstructs one from DNS TXT records, writes it to a temporary directory, marks it executable on Unix, and detached-spawns it via a shell or cmd.exe. The payload is neither authenticated nor package-aligned.

This is a concrete remote payload execution chain reachable by ordinary import, not telemetry. The auxiliary telemetry source contains the same downloader/executor pattern but is not needed to establish the behavior.