The malicious npm package 'dolyame-boxy-desktop-bnpl-title' version 35.6.5 loads an obfuscated module that constructs a rotating list of Cloudflare Workers endpoints and a DNS-TXT covert channel to download platform-specific binaries. These binaries are saved under disguised filenames in temporary directories and executed detached from the main process using shell commands. The package also includes a secondary dropper that reconstructs and executes a payload from base64-encoded DNS TXT records, hidden behind obfuscated code and a fake analytics SDK cover. Environment variables such as DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK serve as kill switches to disable the malicious activity. The package's declared purpose is unrelated to this behavior, indicating deliberate malicious intent.

This malicious package can execute arbitrary native code on the host system by downloading and running disguised binaries, potentially leading to full system compromise. The use of covert channels and obfuscation techniques complicates detection and analysis. The presence of kill switches suggests the malware can evade detection or disable itself under certain conditions.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove version 35.6.5 of dolyame-boxy-desktop-bnpl-title from their environments and avoid installing it. Employ supply chain security best practices such as verifying package integrity and using trusted sources. Monitor for suspicious activity related to this package and binaries named like 'dotnet_diag_<rand>.exe' or '.cache_<rand>'.