dolyame-boxy-desktop-bnpl-title@35.6.5

High-risk behavior combination matched malicious policy.

Runtime import/require of index.js

Arbitrary attacker-controlled native code executes as the importing user.

Remote binary retrieval, temporary-file drop, chmod, and detached shell execution

Requiring index.js loads _init.js. Unless opt-out variables are set, it retrieves a platform-specific binary from rotating worker hosts or DNS TXT records, writes it to a temporary path, marks it executable on Unix, and starts it detached through /bin/sh or cmd.exe. Obfuscated endpoint construction, silent failures, and telemetry naming conceal the payload chain.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. No lifecycle hook is needed because the main entrypoint triggers it.