boxy-add-script @35.2.2

Summary

On require('boxy-add-script'), index.js loads _polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments (oob-worker.cf103-070.workers.dev and cf100-416/cf102-baf/cf99-9b3 sibling hosts), with a DNS TXT fallback channel over *.dl.wel1.ru that reassembles a base64 payload. _polyfill.js downloads a platform-specific binary over https, writes it to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and executable path fragments are split into arrays and joined at runtime to evade static inspection. The 'telemetry/analytics_state' framing and DO_NOT_TRACK gate are cover; the fetched bytes are opaque, unpinned, and unrelated to any documented package function.

Source: amazon-inspector (85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952)