The dolyame-boxy-atom-container npm package (version 35.3.2) includes malicious functionality triggered upon require() of the package. Its index.js loads a helper module that executes a setup() function at module load time. This function selects platform-specific payloads and downloads executable code over HTTPS from rotating obfuscated Cloudflare Workers hostnames. If HTTPS fetching fails, it falls back to reconstructing a base64 payload from DNS-TXT records from multiple domains. The downloaded binaries are saved to temporary directories with executable permissions and launched detached via system shell commands. The package also contains a parallel dropper disguised as an analytics SDK in lib/telemetry.js with similar behavior. The malicious activity is concealed by string manipulation to evade detection. There is no legitimate reason for this native-binary download and execution in a UI components package, no publisher affiliation, and no integrity verification of the downloaded payloads.

This malicious package can lead to arbitrary code execution on the host system by downloading and running unauthorized native binaries. The use of obfuscated and fallback delivery mechanisms increases stealth and persistence potential. Execution of unknown binaries may result in system compromise, data theft, or further malware deployment. Since the package executes code immediately upon import, any project depending on this version is at risk.

No official patch or remediation is currently documented. Users should immediately remove and avoid using version 35.3.2 of dolyame-boxy-atom-container. Verify dependencies for this package and replace with trusted alternatives. Monitor for any unexpected execution of binaries from temporary directories. Since no vendor advisory or patch is available, check the vendor or repository for updates or official guidance regularly.