This threat involves a malicious npm package named 'dolyame-boxy-independent-bnpl-main-title' at version 35.5.6. Upon requiring the package, its index.js loads a _polyfill.js script that reconstructs obfuscated hostnames to reach multiple Cloudflare Workers subdomains. It downloads an opaque platform-specific binary, writes it to temporary storage (/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), sets executable permissions (chmod 0755), and spawns the binary detached from the main process using shell commands. If HTTPS connections are blocked, it uses a DNS TXT chunked-transfer fallback mechanism under the domain *.dl.wel1.ru to reassemble a base64-encoded payload. The package attempts to disguise its malicious behavior using cover-story naming conventions such as _polyfill.js, analytics_state cache markers, and environment variables like DISABLE_TELEMETRY and ANALYTICS_OPT_OUT. This behavior indicates a supply chain compromise via a malicious package masquerading as a Buy Now Pay Later (BNPL) module.

The malicious package can execute arbitrary platform-specific binaries on affected systems, potentially leading to unauthorized code execution and system compromise. The use of obfuscated hostnames and fallback DNS TXT record payload delivery increases the difficulty of detection and blocking. This can result in persistent unauthorized access or further payload delivery on compromised hosts.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove version 35.5.6 of 'dolyame-boxy-independent-bnpl-main-title' from their environments and avoid installing this package. Monitor for any unexpected binaries in temporary directories as described. Since this is a supply chain compromise, verify the integrity and provenance of npm packages before use. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.