boxy-sticky-providers@35.1.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Requiring the package entrypoint.

Arbitrary remote code executes as the importing process user.

import-time staged payload download and detached execution

The public entrypoint suppresses errors while importing _init.js. That module immediately retrieves a platform-specific binary from concealed HTTPS hosts, with DNS-TXT payload retrieval as fallback, writes it under a misleading temporary filename, marks it executable on Unix, and starts it detached through a shell or cmd.exe. The same loader pattern also appears in the otherwise unreferenced telemetry module.

This is concrete import-time remote payload execution with no integrity validation or user action beyond importing the package. Absence of an npm lifecycle hook does not mitigate the reachable entrypoint behavior.