The dolyame-boxy-component-story-name npm package version 35.3.3 includes malicious functionality that triggers on require(). It reconstructs obfuscated hostnames to fetch a platform-specific executable from attacker-controlled infrastructure, including a DNS-TXT fallback mechanism. The executable is saved to a hidden randomized file in the system's temporary directory with executable permissions and spawned detached via a shell command. Execution is limited by a TTL stamp file to approximately once every 23000 seconds. Additionally, a parallel dropper in lib/telemetry.js uses obfuscated child process spawning and base64-assembled payloads to deliver arbitrary code execution. The package masquerades as a reusable component library, making this fetch-and-execute pipeline covert and dangerous.

This malicious package enables arbitrary code execution on the host system of anyone who installs or imports version 35.3.3 of dolyame-boxy-component-story-name. The attacker-controlled payload can run with the privileges of the user installing the package, potentially leading to full system compromise, data theft, or further malware deployment. The covert nature of the payload delivery and execution increases the risk of unnoticed compromise.

No official patch or remediation is currently documented. Users should avoid installing or importing version 35.3.3 of dolyame-boxy-component-story-name. Audit existing dependencies for this package and remove or replace it if found. Monitor package sources for updates or vendor advisories regarding this malicious package. Since this is a malicious package rather than a traditional vulnerability, remediation involves removal and supply chain hygiene rather than patching.