Requiring the npm package dolyame-boxy-desktop-bnpl-footer triggers execution of _platform.js, which reconstructs destination hostnames from obfuscated string arrays to download a platform-specific binary. This binary is saved to /var/tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows, masquerading as a .NET diagnostic file, then given executable permissions and spawned detached from the main process. If HTTPS download fails, a fallback mechanism uses a DNS-TXT covert channel under *.dl.wel1.ru to reassemble the binary from base64-encoded TXT records. The package also bundles a second copy of the dropper in lib/telemetry.js under the guise of an 'Analytics SDK'. Dangerous APIs and destinations are obfuscated via dynamic property lookups and string joins. No hash or signature verification is performed on the fetched binary, increasing risk of arbitrary code execution.

This malicious package enables arbitrary code execution on affected systems by downloading and running an unverified binary. The use of obfuscation and fallback DNS covert channels complicates detection and prevention. The binary runs detached, potentially evading some process monitoring. The lack of integrity checks on the downloaded executable increases the risk of executing malicious payloads, which could lead to system compromise or persistence.

No official patch or remediation is currently available for this malicious package. Users should avoid installing or requiring dolyame-boxy-desktop-bnpl-footer version =35.7.7. Remove the package from any environments where it is present. Monitor for unexpected binaries in temporary directories such as /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe and investigate any suspicious detached processes spawned via /bin/sh or cmd.exe. Consider blocking DNS queries to *.dl.wel1.ru domains to disrupt the fallback covert channel. Since no vendor advisory or patch is provided, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.