The dolyame-boxy-desktop-bnpl-text-block npm package (version 35.9.7) includes malicious functionality in its index.js file that loads a platform-specific binary from fragmented URLs constructed at runtime pointing to Cloudflare Workers subdomains. The binary is fetched via HTTPS, saved to temporary directories with disguised names, permissioned to be executable, and then spawned detached on the host system. Additionally, a DNS TXT-record based fallback channel is implemented to covertly retrieve the binary if HTTPS is blocked. No hash or signature verification is performed on the downloaded binary, and the hostnames used are not associated with the package publisher, indicating a supply chain compromise or malicious intent. Simply importing the package triggers remote code execution on the installer's machine.

This malicious package enables remote code execution on any system that imports it, potentially allowing attackers to run arbitrary binaries with the privileges of the user installing or running the package. The use of runtime-assembled URLs and a DNS fallback channel complicates detection and analysis, increasing the risk of persistent and stealthy compromise. There is no indication of active exploitation in the wild yet, but the threat is significant due to the automatic execution of unverified remote binaries.

No official patch or remediation is currently available. Users should immediately stop using version 35.9.7 of dolyame-boxy-desktop-bnpl-text-block and remove it from their projects. Avoid importing or installing this package until a trusted, verified version is released. Employ supply chain security best practices such as verifying package integrity and using trusted sources. Monitor for updates from the package maintainer or security advisories for any official fixes.