The npm package dolyame-boxy-atom-bnpl-text version 35.8.7 includes a malicious payload that triggers on require(). It loads a helper script that initiates a process to fetch a platform-specific binary from dynamically reconstructed hostnames via HTTPS. The binary is saved to temporary system directories with obfuscated filenames, permissioned as executable, and launched detached from the main process using shell commands. No hash or signature verification is performed on the downloaded binary, increasing risk. The package also contains a telemetry.js file with similar dropper functionality masked as an analytics SDK. This behavior indicates the package is a malicious dropper designed to execute arbitrary code remotely.

This malicious package enables remote code execution on any system that installs and requires it, potentially allowing attackers to run arbitrary binaries without user consent or verification. The lack of integrity checks on the downloaded payload increases the risk of executing untrusted code. The obfuscation of hostnames and filenames complicates detection and analysis. This can lead to system compromise, data theft, or further malware deployment depending on the downloaded binary's payload.

No official patch or remediation is currently available. Users should immediately remove the affected version (=35.8.7) of dolyame-boxy-atom-bnpl-text from their projects and avoid installing this package. Employ strict package source verification and audit dependencies for unexpected network activity or binary downloads. Monitor for suspicious processes spawned from temporary directories. Consider using package integrity verification tools and restricting execution permissions in build environments to prevent unauthorized code execution.