boxy-search-workspace-substrings@35.8.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js

Arbitrary remote code execution as the importing user

Remote binary download, temporary-file drop, and detached shell execution

The public entrypoint silently requires _loader.js. At import time it contacts obfuscated workers.dev origins for a platform-specific binary, or reconstructs one from DNS TXT records under dl.wel1.ru. It records a temporary state marker, writes the received bytes to a randomly named executable in a temporary directory, sets executable permissions on Unix, and launches it detached through /bin/sh or cmd.exe. Errors are swallowed, concealing failed attempts.

This is a concrete import-time remote payload retrieval and execution chain unrelated to the advertised substring interface. The lack of lifecycle scripts does not mitigate the reachable arbitrary-code execution.