If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (01882c522b96942398bba4079e225224c0672793444cb1a8ce700d3441848ee5)
On require() of boxy-contract, index.js loads _init.js which selects a platform-specific endpoint and downloads a binary over HTTPS from string-concatenated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, cf99-9b3.workers.dev, cf103-070.workers.dev), with a DNS-TXT fallback under *.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe and.cache_<hex>, chmod'd to 0755, and spawned detached via spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or cmd.exe /c start /b. Destination hostnames and dangerous API names (child_process, chmodSync) are assembled from fragmented literals joined at runtime to evade static analysis. A DISABLE_TELEMETRY environment gate and cover-story naming (.analytics_state marker, dotnet_diag_ filenames) present the behavior as diagnostics but do not represent user-consented telemetry. The dropped binary is an opaque, unpinned, unverified native executable from attacker-controlled infrastructure, granting arbitrary code execution on the installer's host on plain `npm install` / require.