boxy-service@35.6.4

High-risk behavior combination matched malicious policy.

Any runtime require of boxy-service through index.js.

Arbitrary native code execution as the importing process user.

Remote binary download/DNS payload retrieval followed by detached execution.

The main entrypoint suppresses errors while importing _compat.js. On import, that module downloads an opaque platform-specific payload from obfuscated rotating hosts, with DNS TXT records as a fallback. It saves the payload under a random temporary filename, makes it executable on Unix, and launches it detached via a shell or cmd.exe, without validating its origin or integrity.

This is a concrete import-time remote-code-execution chain disguised as compatibility/telemetry behavior. Absence of an npm lifecycle script does not mitigate execution when consumers import the package.