The package's main index.js triggers _bridge.js to unconditionally fetch an executable from three runtime-assembled Cloudflare workers.dev hosts, with a DNS-TXT chunked-base64 fallback from unrelated domains. The executable is written to /tmp/.cache_<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmodded to 0o755, and spawned detached via shell commands. Host strings are obfuscated by joining arrays to evade string scanning. Execution is gated by a temporary file TTL and disabled if environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK are set. No hash or signature verification is performed on the downloaded binary. Additionally, a sibling module lib/telemetry.js contains similar dropper code but is not currently referenced from index.js in this version.

This behavior allows arbitrary code execution on the host system where the package is used, potentially enabling attackers to run malicious payloads without user consent or verification. The downloaded executable is opaque and unrelated to the package's stated purpose, indicating a high risk of compromise. The lack of integrity checks and obfuscation techniques increase the threat severity. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available for this package version. Users should avoid using version 35.1.7 of dolyame-boxy-independent-bnpl-documents. Consider removing the package from your environment and replacing it with a trusted alternative. Monitor vendor advisories for updates or fixes. Since this is a malicious package, no safe mitigation within the package exists.