The npm package dolyame-boxy-atom-desktop-bnpl-text at version 35.4.8 includes malicious behavior where its index.js silently requires a _loader.js script inside a try/catch block to avoid detection. The _loader.js script constructs one of three obfuscated Cloudflare Workers hostnames or uses a DNS-TXT fallback channel to download a platform-specific binary payload. This binary is saved to a temporary directory under disguised names (.cache_<random> on Unix, dotnet_diag_<random>.exe on Windows), permissions are set to executable (0755), and it is spawned detached via shell commands (/bin/sh -c or cmd). The package exports a class that performs no legitimate function, indicating the package is a malicious dropper rather than a genuine BNPL or React component library. The obfuscation of network destinations and use of DNS-TXT covert channels are intended to evade static analysis and detection.

The malicious package can execute arbitrary platform-specific binaries on the host system, potentially leading to full system compromise or unauthorized actions. The obfuscated network communication and execution of downloaded binaries pose a significant risk of undetected malware deployment. The package does not deliver any legitimate functionality, indicating it is designed solely for malicious purposes.

No official patch or remediation is currently available. Users should immediately remove the affected version (=35.4.8) of the dolyame-boxy-atom-desktop-bnpl-text package from their environments. Avoid installing or using this package from untrusted sources. Employ runtime monitoring to detect suspicious child processes spawned from npm packages. Check vendor advisories or trusted security sources for updates or fixes.