The npm package dolyame-boxy-desktop-bnpl-header version 35.8.8 is malicious. Its index.js file unconditionally loads _bootstrap.js, which downloads a platform-specific binary from a set of suspicious hostnames assembled dynamically to evade detection. The binary is saved to temporary directories with hidden decoy filenames, permissions are set to executable, and it is spawned detached via shell commands. Hostnames and API names are constructed at runtime to defeat static analysis. Additionally, a larger malicious payload is shipped as lib/telemetry.js under the guise of an analytics SDK, employing the same drop-and-execute pattern.

This malicious package can execute arbitrary binaries on the host system without user consent, potentially leading to unauthorized code execution, persistence, and further compromise. The use of decoy filenames, dynamic hostname assembly, and detached execution complicates detection and mitigation efforts. The presence of a secondary payload disguised as an analytics SDK increases the attack surface and stealth of the malicious activity.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove version 35.8.8 of dolyame-boxy-desktop-bnpl-header from their environments and avoid installing it. Employ supply chain security measures such as verifying package integrity and source authenticity before installation. Monitor for any signs of compromise related to this package and consider using security tools that detect runtime code injection and suspicious network activity.