The package's index.js unconditionally requires a _bridge.js module that selects a payload based on the platform (linux x64/arm64, darwin, win32). It downloads a native binary over HTTPS from hardcoded Cloudflare workers.dev endpoints, writes it to temporary directories under names mimicking benign artifacts, sets executable permissions on POSIX systems, and spawns the binary detached via shell commands. A DNS TXT record covert channel provides fallback payload sources from sdk.dl.wel1.ru and related domains. Additionally, a secondary dropper labeled as an "Analytics SDK" is included but not currently invoked. The package's actual behavior is malicious and unrelated to its advertised BNPL banner functionality.

This malicious package can lead to arbitrary native code execution on affected systems, potentially allowing attackers to run unauthorized code with the privileges of the user installing the package. The use of multiple platform-specific payloads and covert DNS fallback channels increases the stealth and persistence of the threat. This compromises system integrity and could facilitate further malicious activities.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.2.1) of the dolyame-boxy-independent-bnpl-main-banner package from their environments. Avoid installing or using this package version. Monitor for updates from the package maintainer or npm advisories for any official fixes or guidance. Consider scanning existing environments for presence of this package and any downloaded payloads.