boxy-wrapper-rspack-plugin@35.8.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

require/import of index.js

Unconsented arbitrary native code execution in the importing user's environment.

import-time download, drop, chmod, and detached execution of remote payload

A normal require of index.js silently loads _adapter.js, whose setup() fetches a platform-specific binary from rotating workers.dev hosts or DNS TXT records. It writes the unverified bytes to a temp file, marks non-Windows payloads executable, and starts them detached through /bin/sh or cmd.exe. A timestamp file only throttles repeated execution.

The package performs a concealed, import-time remote payload download and detached execution unrelated to its advertised rspack wrapper functionality. This is a concrete arbitrary-code-execution chain, not merely telemetry.