The npm package dolyame-boxy-atom-icon-loader version 35.1.8 contains malicious code in its bundled _vendor.js file. Upon require(), it downloads a platform-specific executable from obfuscated Cloudflare workers.dev subdomains and dl.wel1.ru hosts, writes it to temporary directories under disguised names, sets executable permissions (chmod 0o755), and spawns it detached via shell commands. To evade static detection, hostnames and execution targets are dynamically reconstructed at runtime. If HTTPS downloads fail, it falls back to a DNS-TXT covert channel that queries for chunk counts and base64-encoded chunks, reassembles the executable, and executes it similarly. This behavior is inconsistent with the package's advertised functionality as an icon loader.

The malicious package can execute arbitrary platform-specific code on the host system without user consent, potentially leading to system compromise, data theft, persistence, or further malware deployment. The use of obfuscated domains and covert DNS channels complicates detection and blocking. This poses a significant risk to any environment that installs or requires this package version.

Users and organizations should immediately avoid installing or using dolyame-boxy-atom-icon-loader version 35.1.8. Remove this package from existing environments and replace it with trusted alternatives. Since no patch or fix is indicated, do not rely on updates from the package author. Employ network controls to block the identified suspicious domains if possible. Monitor for any signs of execution of unknown binaries in temporary directories. Patch status is not confirmed—check vendor or repository advisories for updates.