The npm package dolyame-boxy-atom-bnpl-button version 35.8.3 includes malicious functionality where its index.js loads a helper script that fetches a platform-specific binary from obfuscated hosts assembled via array-join to evade detection. It writes the fetched binary to temporary directories with randomized names, sets executable permissions, and spawns the binary detached from the main process. The package uses a DNS-TXT chunked-base64 fallback channel to a secondary domain to deliver payloads covertly when HTTPS egress is blocked. No integrity or signature verification is performed on the downloaded binary, allowing arbitrary code execution controlled by the attacker on any host that installs this package. The behavior is disguised as telemetry with misleading file names and comments. A lockfile throttles re-fetching to maintain a scheduled beacon pattern.

Any system that installs the affected version of this package (35.8.3) will execute attacker-controlled arbitrary code, potentially compromising the host. The lack of integrity checks and use of covert channels increases the risk of undetected persistent compromise. This can lead to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented. Users should avoid installing or using version 35.8.3 of the dolyame-boxy-atom-bnpl-button package. If already installed, remove the package and investigate the system for signs of compromise. Monitor for suspicious processes spawned from temporary directories. Check vendor advisories or trusted security sources for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.