dolyame-boxy-independent-bnpl-video@35.4.4

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary attacker-supplied native code executes under the importing process user.

Remote payload download, DNS fallback, temp-file drop, and detached execution.

The main entry silently imports _adapter.js. Its immediately invoked start routine fetches a binary from rotating workers.dev endpoints or DNS TXT records, saves it in a temporary directory, makes it executable on Unix, and starts it detached through a shell or cmd.exe. The stamp file and telemetry-like names obscure repeat execution.

This is concrete import-time remote code execution, not legitimate telemetry: arbitrary downloaded bytes are executed without user action or verification.