This threat involves a malicious npm package (dolyame-boxy-atom-bnpl-store-button-set, version 35.9.5) that, when required, loads a script which reconstructs download hostnames from obfuscated arrays and fetches a native binary payload from anonymous workers.dev hosts. The payload is saved to temporary locations with disguised names, permissioned as executable, and spawned detached via shell commands. Additionally, a secondary covert channel using DNS-TXT records from multiple dl.wel1.ru subdomains delivers base64-encoded payload chunks as a fallback. Execution is gated by filesystem stamps and environment variables designed to appear as telemetry opt-outs. The package's behavior is inconsistent with its advertised functionality, indicating malicious intent.

The malicious package enables unauthorized execution of native binaries on the host system, potentially leading to full system compromise or persistent backdoor installation. The use of covert DNS-TXT channels for payload delivery complicates detection and analysis. Because the payload executes at require time, any project depending on this package is at immediate risk upon installation or runtime. No known exploits in the wild have been reported yet.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid using the affected version (=35.9.5) of dolyame-boxy-atom-bnpl-store-button-set. Remove any installations of this package from your environment and audit for any spawned processes or downloaded payloads in temporary directories. Monitor for suspicious network connections to the indicated domains (workers.dev and dl.wel1.ru subdomains). Consider using trusted package sources and supply chain security tools to detect and block malicious npm packages.