The npm package dolyame-boxy-independent-bnpl-features at version 35.9.5 includes malicious code that, upon require(), downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints with a DNS TXT chunked-transfer fallback via *.dl.wel1.ru. The binary is saved to temporary directories under disguised filenames (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), permissions are set to executable (0755), and it is spawned detached via /bin/sh or cmd. Hostnames and resolver domains are assembled from split string fragments to evade static analysis. A flag file named /tmp/.analytics_state is used as a run stamp but does not correspond to any real analytics functionality, serving as a cover. Execution is only guarded by opt-out environment variables, so a default install and require chain results in execution of attacker-controlled code with the user's privileges.

This malicious package allows execution of attacker-controlled binaries with the privileges of the user running the Node.js process. This can lead to arbitrary code execution, potential system compromise, data theft, or further malicious activity on the affected host. Because the execution is automatic unless explicitly opted out, users installing and requiring this package are at risk.

No official patch or remediation is currently documented. Users should avoid installing or requiring version 35.9.5 of dolyame-boxy-independent-bnpl-features. If already installed, remove the package and scan for any suspicious binaries in temporary directories. Monitor environment variables that could disable execution as a temporary opt-out measure, but this is not a reliable mitigation. Check vendor advisories or trusted security sources for updates or patches.