The npm package dolyame-boxy-independent-bnpl-info-slider version 35.1.9 includes malicious functionality where its index.js loads a _vendor.js script that downloads a platform-specific binary from a list of obfuscated Cloudflare Workers hosts, with DNS-TXT chunked base64 fallback to additional domains. The downloaded binary is saved to temporary directories with deceptive names, permissions are set to executable, and it is spawned detached via shell commands. A secondary module, lib/telemetry.js, mimics this behavior as a redundant dropper under the guise of an analytics SDK. Hostnames and sensitive API identifiers are dynamically reconstructed at runtime to evade static detection. The package attempts to simulate hygiene via opt-out environment variables and a TTL lock file, but these do not prevent the malicious payload execution.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent, potentially leading to unauthorized code execution, persistence, and further compromise of the affected environment. The obfuscation and redundant droppers increase the difficulty of detection and removal.

No official patch or remediation is currently documented. Users should avoid using version 35.1.9 of dolyame-boxy-independent-bnpl-info-slider and remove it from their environments. Since this is a malicious package, the best mitigation is to audit dependencies and replace or remove this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.