The npm package dolyame-boxy-independent-bnpl-faq version 35.8.7 includes a malicious runtime component that dynamically constructs hostnames to download a base64-encoded payload from obfuscated Cloudflare Workers endpoints and DNS TXT record fallbacks. This payload is written to temporary locations on the filesystem with executable permissions and launched detached using system shell commands on both Unix-like and Windows systems. The use of runtime-assembled hostnames and TTL caching evades static analysis and repeated execution, while environment variables can opt out of execution. The package's legitimate BNPL-FAQ functionality is unrelated to this malicious behavior, indicating the package is a supply chain threat.

This malicious package can execute arbitrary native code on the host system by downloading and running opaque binaries from attacker-controlled infrastructure. This can lead to full system compromise, persistence, and further malicious activity. The obfuscation and runtime assembly of hostnames complicate detection and prevention. There are no known exploits in the wild reported yet, but the potential impact is high due to arbitrary code execution.

No official patch or remediation is currently available. Users should immediately remove the affected version (=35.8.7) of the dolyame-boxy-independent-bnpl-faq package from their environments. Avoid installing or using this package until a trusted, clean version is released. Employ supply chain security best practices such as verifying package integrity and provenance. Monitor for suspicious execution of binaries in temporary directories as described.