The npm package dolyame-boxy-independent-bnpl-info-images (version 20.7.2) contains embedded malicious code in its _adapter.js file. Upon requiring the package, it dynamically constructs hostnames to download a binary payload from Cloudflare workers.dev domains with a DNS TXT fallback via *.dl.well1.site. The binary is saved to temporary directories under misleading filenames, permissioned to be executable, and launched detached via shell commands. The package's public API functions are inert wrappers, with the actual malicious behavior occurring immediately on import. No hash or signature verification is performed on the downloaded binary, and the hosting domains are unrelated to the package's purported functionality. This behavior effectively compromises any system running the package.

Any system with this package installed or running is considered fully compromised due to the covert download and execution of an unverified binary payload. Attackers potentially gain full control over the affected host, risking exposure or theft of all stored secrets and keys. Removal of the package alone does not guarantee eradication of all malicious components or persistence mechanisms established by the payload.

Immediate removal of the dolyame-boxy-independent-bnpl-info-images package version 20.7.2 is recommended. All secrets, credentials, and keys stored on the affected system should be rotated from a separate, secure environment. Due to the high likelihood of full system compromise, a thorough incident response and system rebuild may be necessary. No official patch or fix is available; therefore, avoid using this package entirely.