This threat involves a malicious npm package named dolyame-boxy-independent-bnpl-info-images, specifically version 20.7.2. When the package is imported, its index.js loads _adapter.js, which dynamically constructs hostnames to download a binary payload from Cloudflare workers.dev and a fallback DNS TXT channel. The binary is saved to temporary directories with decoy names, permissions are set to executable, and it is spawned detached via shell commands. The package's public API does not perform any legitimate function, serving only as a decoy. No hash or signature verification is performed on the downloaded binary, and the domains used for payload delivery are unrelated to the package's purported functionality.

The malicious package silently downloads and executes an unverified binary on the host system, potentially allowing arbitrary code execution. This behavior can lead to system compromise, persistence, and further malicious activity depending on the payload. The lack of integrity checks and use of evasive hostname assembly techniques increase the risk of undetected exploitation.

No official patch or remediation is currently documented for this package version. Users should avoid using the dolyame-boxy-independent-bnpl-info-images package version 20.7.2. Remove any installations of this package and audit systems for the presence of the downloaded binaries and any suspicious processes spawned by it. Monitor for network connections to the described domains and consider blocking them. Check vendor advisories or trusted security sources for updates or official remediation guidance.