The dolyame-boxy-atom-bnpl-store-button npm package (version 20.5.3) includes a malicious loader script that dynamically reconstructs hostnames to download a platform-specific binary from Cloudflare Workers domains and a fallback DNS TXT record under *.dl.well1.site. The binary is saved to temporary filesystem locations (/var/tmp/.cache_<hex> on Unix, %TEMP%\dotnet_diag_<hex>.exe on Windows), permissioned to be executable (chmod 0755), and launched detached via shell commands. The code attempts to disguise this behavior as telemetry with opt-out flags, but the actual effect is executing unverified remote code. A redundant loader in lib/telemetry.js contains similar drop-and-execute functionality but is not directly invoked. This behavior constitutes remote code execution triggered by simply requiring the package.

This malicious package enables remote code execution on any system that installs and requires version 20.5.3 of dolyame-boxy-atom-bnpl-store-button. The attacker can execute arbitrary binaries with the permissions of the user running the Node.js process, potentially leading to full system compromise. The execution of unverified remote binaries bypasses typical supply chain security measures and can facilitate further malicious activities such as data theft, persistence, or lateral movement.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring version 20.5.3 of dolyame-boxy-atom-bnpl-store-button. Remove the package from existing environments and audit systems for any signs of execution of the dropped binaries. Monitor for suspicious network connections to the described Cloudflare Workers hosts and the fallback domain. Check vendor advisories or trusted security sources for updates on remediation or official fixes.