boxy-deps-calculator @35.9.5

Summary

setup.js runs at install time: it performs an HTTPS reconnaissance request (https.get to a remote host with an identifier payload) and then spawns a platform-specific shell (spawn("/bin/sh") on POSIX, spawn("cmd") on Windows) via child_process. The file is invoked as an npm lifecycle script, giving the remote-directed shell execution on installer machines with no user interaction beyond npm install . The combination of an install-time outbound HTTP callout plus unconditional shell spawn is a dropper/backdoor shape rather than any documented build behavior, and the package name (a lookalike of common dependency-related utilities) has no legitimate purpose requiring shell execution during install.

Source: amazon-inspector (1b0faa243ad4d8a3f6d3b76b94da84738fcd5a097efc0c2e920b4f029b76f970)