boxy-use-what-changed@35.4.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary native code execution under the importing process's user account.

remote binary download, drop, and detached execution

A normal package import reaches index.js, which silently requires _ext.js. Its init routine downloads a platform-specific payload from obfuscated worker hosts, or reconstructs one from DNS TXT records. If sufficiently large, it writes the bytes to a temporary executable path, makes Unix payloads executable, and launches them detached via shell or cmd.exe.

This is concrete, hidden, import-time staged payload execution unrelated to the declared lightweight wrapper API. The lack of lifecycle scripts does not mitigate execution when consumers import the module.