The dolyame-boxy-atom-bnpl-popup npm package version 35.9.3 contains malicious code embedded in _compat.js and lib/telemetry.js. These scripts dynamically assemble URLs to fetch opaque binaries from Cloudflare workers.dev subdomains and a fallback DNS TXT service under dl.wel1.ru. The binaries are saved to temporary directories with decoy filenames, permissions are set to executable, and the binaries are executed detached via shell commands. The code uses obfuscation techniques such as string splitting and environment variable gating (DISABLE_TELEMETRY) to evade detection. This results in arbitrary attacker-controlled code execution on the machine loading the package.

An attacker can achieve arbitrary code execution on the system of any user who installs and loads this specific version (35.9.3) of the dolyame-boxy-atom-bnpl-popup npm package. This can lead to full system compromise, data theft, or further malware deployment. There is no indication of active exploitation in the wild yet.

No official patch or remediation is currently documented. Users should avoid installing or using version 35.9.3 of dolyame-boxy-atom-bnpl-popup. Consider removing this package from existing environments. Monitor vendor advisories or trusted security sources for updates or fixes. Due to the nature of the malicious code executing at package load, runtime detection may be difficult.