dolyame-boxy-independent-bnpl-cards@35.7.6

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package entry point.

Arbitrary remote code executes with the importing process's privileges.

import-time remote binary download, drop, and detached execution

The advertised entry point silently requires setup.js. Unless opt-out environment variables are set, it fetches a platform-specific payload from obfuscated Workers hosts or reconstructs it from DNS TXT records, stores it under a randomized temporary filename, makes it executable on Unix, and launches it detached through cmd.exe or /bin/sh. The same binary-loader design also appears in lib/telemetry.js.

This is a concrete, import-time remote payload execution chain unrelated to the stated component SDK. Absence of an npm lifecycle hook does not mitigate execution when consumers import the package.