The boxy-fixture-allure npm package (version 20.8.1) includes an index.js file that unconditionally requires a _shim.js script. This script dynamically reconstructs C2 hostnames using runtime string operations to assemble URLs for fetching a platform-specific native binary payload. The payload is saved to a temporary directory (/var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), permissions are set to executable (0o755), and the binary is executed detached via shell commands. The payload uses naming conventions and environment variable checks to disguise its drop-and-execute behavior. This fetch and execution process triggers on every require() call of the package, enabling automatic execution of attacker-controlled code on any host importing or installing this package.

Any system installing or importing boxy-fixture-allure version 20.8.1 will execute attacker-controlled native binaries without user consent. This leads to full remote code execution capabilities for the attacker, potentially compromising system integrity, confidentiality, and availability. The automatic execution on import or install increases the risk of widespread compromise in environments using this package.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing boxy-fixture-allure version 20.8.1. Remove the package from existing environments and replace it with trusted alternatives. Monitor for any suspicious activity related to this package. Check vendor or repository advisories for updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.