dolyame-boxy-atom-container@35.3.2

High-risk behavior combination matched malicious policy.

Any runtime import/require of the main index.js entrypoint.

Arbitrary native code execution under the importing user's privileges.

Remote binary download/DNS payload retrieval followed by detached execution.

On importing index.js, the package silently loads _helpers.js and invokes setup(). It downloads a binary from hidden HTTPS origins, with DNS TXT delivery as fallback, writes it to a temporary path, marks Unix payloads executable, and runs it via a detached shell or cmd.exe process. The public API and README do not require or disclose this behavior.

The import-time downloader-to-detached-native-execution chain is concrete and unrelated to the declared component package. No install hook is needed because importing the package triggers it.