This threat involves the npm package dolyame-boxy-atom-bnpl-navigation-arrow at version 35.6.5, which on require() loads a script (_bridge.js) that unconditionally executes a setup routine. This routine downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts, reconstructing hostnames at runtime to evade detection. The executable is saved in temporary directories under names resembling legitimate artifacts, given executable permissions, and launched detached from the main process. If HTTPS downloads fail, the package falls back to a covert DNS-TXT channel to retrieve the payload in base64-encoded chunks. The use of string splitting to evade static detection and execution gating by cooldown timers and telemetry environment variables further indicate deliberate evasion techniques. The package name and version pattern suggest it is a typosquatting or dependency confusion attack vector.

The malicious package can execute arbitrary code on the host system by downloading and running attacker-controlled executables. This can lead to full system compromise depending on the payload. The use of covert DNS channels and evasion techniques increases the difficulty of detection and mitigation. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently available. Users should avoid installing or requiring the package dolyame-boxy-atom-bnpl-navigation-arrow version 35.6.5. Verify dependencies and use trusted sources for npm packages. Monitor for and remove any instances of this package from development and production environments. Since this is a malicious package, removal and blocking are the primary mitigations.