This threat involves a malicious npm package (dolyame-boxy-independent-bnpl-code-text, version 35.7.8) that executes a multi-stage attack. When the package is required, it loads a script (_ext.js) that fetches an executable payload from obfuscated Cloudflare Workers domains, with a fallback to DNS-TXT record retrieval from a suspicious domain. The payload is reconstructed from base64-encoded chunks, saved to temporary directories with disguised filenames, permissions are set to executable, and the payload is executed in a detached process using shell commands. The package attempts to evade detection by reconstructing hostnames dynamically and framing the behavior as opt-out telemetry, checking environment variables and a local analytics state file. The telemetry.js module contains similar code that corroborates the malicious write-chmod-exec execution pattern.

The malicious package can execute arbitrary platform-specific code on the host system without user consent, potentially leading to unauthorized system compromise, persistence, and further malicious activity. The use of obfuscated network communication and covert DNS channels complicates detection and analysis. The threat affects any environment where this specific package version is installed and required.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove the affected package version (=35.7.8) from their environments and avoid installing or requiring this package. Employ supply chain security measures such as verifying package integrity and source reputation before installation. Monitor for any signs of compromise related to this package and investigate systems where it was used. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.