This malicious npm package unconditionally requires a loader script that selects a platform-specific binary payload path and downloads the payload from obfuscated Cloudflare Workers hostnames constructed at runtime. It uses DNS TXT-record base64 fallback domains as secondary download sources. The downloaded binary is saved to temporary directories with deceptive filenames such as '.cache_<hex>' or 'dotnet_diag_<hex>.exe', permissions are set to executable, and the binary is executed detached via shell commands. A sibling telemetry script mimics Sentry error reporting but wraps the same download and execution primitives. There is no hash, signature, or publisher verification on the downloaded payload, enabling arbitrary code execution at import time. The package name is a typosquat style, and the overall behavior is consistent with a malicious import-time dropper.

Successful import of this package results in arbitrary code execution on the host system through the download and execution of an unverified binary payload. This can lead to full system compromise depending on the payload's capabilities. The malicious code operates silently and uses obfuscation techniques to evade detection.

No official patch or remediation guidance is available. Users should immediately remove this package from their projects and avoid installing or using 'dolyame-boxy-independent-bnpl-navigation' version 35.9.3. Employ supply chain security best practices such as verifying package authenticity and using trusted sources. Monitor for any suspicious activity related to this package.