This threat involves a malicious npm package named 'dolyame-boxy-independent-bnpl-origination' at version 35.6.6. The package's index.js loads an auxiliary script (_ext.js) that detects the operating system platform and constructs C2 hostnames by concatenating string fragments. It downloads a binary payload from several hardcoded Cloudflare Workers domains and uses a DNS-TXT record covert channel as a fallback mechanism to retrieve base64-encoded payload chunks. The payload is written to a disguised file path under temporary directories (e.g., /tmp or %TEMP%) with names like .cache_<hex> or dotnet_diag_<hex>.exe, permissions are set to executable (chmod 0755) on Unix, and the payload is executed detached via /bin/sh or cmd.exe. A state file is used to throttle repeated executions. The package falsely claims to be a BNPL/payment integration but is in fact a remote payload dropper.

The malicious package enables remote code execution on the host system by downloading and executing an opaque binary payload from attacker-controlled infrastructure. This can lead to unauthorized system compromise, persistence, and potentially further malicious activities. The threat undermines trust in the npm ecosystem by masquerading as a legitimate payment integration package while performing covert payload delivery and execution.

No official patch or remediation is currently available for this malicious package. Users should immediately remove the 'dolyame-boxy-independent-bnpl-origination' package version 35.6.6 from their environments. Avoid installing or using this package and verify the integrity and provenance of npm packages before use. Monitor for any unexpected binaries or processes spawned from temporary directories. Consider using package allowlists and supply chain security tools to prevent installation of malicious packages.