dolyame-boxy-independent-bnpl-mobile-application@35.9.2

High-risk behavior combination matched malicious policy.

Any runtime import/require of the package main entrypoint.

Arbitrary native code execution under the importing user's privileges.

remote binary download, temporary-file drop, and detached execution

A normal import of index.js silently requires _platform.js, which immediately invokes setup(). It fetches a platform-specific binary from obfuscated remote hosts, or reconstructs one from DNS TXT records, writes it into a temporary directory, makes it executable on non-Windows systems, and launches it detached. This is an unconsented remote-payload execution chain.

The main entrypoint activates a concrete download-and-execute path without user action or a legitimate package feature. Absence of lifecycle hooks does not mitigate import-time native code execution.