This threat involves the npm package dolyame-boxy-atom-desktop-bnpl-container version 35.3.3, which upon require() loads a bootstrap script that reconstructs obfuscated remote hostnames and downloads a platform-specific binary over HTTPS or via DNS TXT record chunked base64 encoding if HTTPS is unavailable. The binary is saved to temporary system directories with filenames designed to impersonate legitimate diagnostic/cache files, given executable permissions, and executed detached and unreferenced with standard IO ignored. The package does not contain code related to its stated BNPL purpose, and the downloaded payload is neither pinned nor hash-verified, indicating a high risk of malicious activity and evasion of static inspection and network filtering.

The malicious package can execute arbitrary code on the host system by downloading and running an opaque binary without integrity verification. This can lead to unauthorized system compromise, persistence, and potential further malicious activity. The use of DNS TXT records as a fallback channel allows bypassing of HTTPS egress filtering, increasing the likelihood of successful payload delivery in restricted network environments.

No official patch or remediation is currently available for this malicious package. Users should avoid installing or using version 35.3.3 of dolyame-boxy-atom-desktop-bnpl-container. Remove any installations of this package and monitor for suspicious activity related to its execution. Employ network controls to detect or block connections to the identified obfuscated domains and DNS TXT record queries associated with this threat. Verify package authenticity before installation and prefer trusted sources.