dolyame-boxy-independent-bnpl-info-images@20.7.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Requiring index.js at runtime.

Arbitrary remote code execution as the consuming process user.

remote binary download, DNS payload fallback, and detached execution

At import time, index.js loads _adapter.js. The adapter selects a platform payload path, downloads a binary from rotating Worker hosts or reconstructs it through DNS TXT records, writes it under a temporary directory, makes it executable on Unix, then launches it detached through /bin/sh or cmd.exe. The timestamp marker only limits repeat execution.

This is a concrete, hidden remote payload execution chain triggered by a normal import, unrelated to the package’s minimal advertised wrapper API. The lack of an install hook does not mitigate runtime arbitrary code execution.