The npm package dolyame-boxy-atom-bnpl-image-card version 35.7.7 includes a malicious setup.js script that, upon import, dynamically reconstructs hostnames to fetch a platform-specific binary from Cloudflare Workers subdomains to evade static detection. It also uses a DNS-TXT fallback mechanism under *.dl.wel1.ru to retrieve base64-encoded binary chunks, which are concatenated and decoded. The binary is saved to temporary directories with misleading filenames, permissions are set to executable on POSIX systems via split calls to evade detection, and the binary is spawned detached using child process methods. A sibling telemetry module contains similar dropper code, suggesting a shared malicious codebase. This behavior triggers automatically without any lifecycle hooks, meaning any use of the package results in execution of the malicious payload.

The malicious code executes automatically when the package is imported, resulting in the download and execution of a potentially harmful binary on the host system. This can lead to unauthorized code execution, persistence, and possible further compromise of the affected system. The obfuscation techniques used (dynamic hostname reconstruction, DNS-TXT fallback, split function calls) indicate an attempt to evade detection by static analysis tools.

No official patch or remediation guidance is provided. Users should avoid using version 35.7.7 of the dolyame-boxy-atom-bnpl-image-card package. Consider removing the package from projects and replacing it with trusted alternatives. Monitor for any unusual process execution related to this package and investigate systems where this version was installed.