This malicious npm package, dolyame-boxy-atom-bnpl-store-button version 20.5.3, upon being required, loads a loader script that downloads a platform-specific binary from obfuscated Cloudflare Workers domains. The binary is saved to temporary filesystem locations with executable permissions and launched detached from the main process. The package uses string obfuscation to hide hostnames and disguises this behavior as telemetry with opt-out flags. A secondary telemetry library with similar drop-and-execute functionality is included but not directly referenced. The package's observable effect is limited to fetching and executing an unverified remote binary, which results in full system compromise.

Any system with this package installed or running should be considered fully compromised. The attacker gains full control over the affected computer, potentially accessing all stored secrets and keys. Immediate rotation of all credentials from a separate, trusted system is required. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the executed binary.

Remove the dolyame-boxy-atom-bnpl-store-button package immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Due to the nature of the compromise, assume full system compromise and consider rebuilding or thoroughly cleaning the system. There is no official patch or fix available; remediation requires removal and credential rotation.