This threat involves a malicious npm package named 'dolyame-boxy-independent-bnpl-product-grid' at version 35.9.2. Upon requiring its index.js, a runtime script selects a platform-specific payload path and rotates through several obfuscated Cloudflare Workers hosts to download an opaque binary payload. If these hosts are unreachable, it uses a covert channel by reassembling a base64 payload from DNS TXT records across multiple domains. The binary is saved to temporary directories with decoy filenames, permissions are set to executable, and it is launched detached from the main process using shell commands. A stamp file prevents repeated execution. The package name is crafted to impersonate a legitimate BNPL/e-commerce package to deceive users.

The malicious package can execute arbitrary binary code on the victim's system, potentially leading to unauthorized code execution and compromise. The use of obfuscated payload delivery and fallback covert channels complicates detection and mitigation. The impersonation of a legitimate package increases the risk of inadvertent installation by developers.

No official patch or remediation is currently available for this malicious package. Users and organizations should avoid using the 'dolyame-boxy-independent-bnpl-product-grid' package version 35.9.2. It is recommended to verify package authenticity before installation and rely on trusted sources. Monitor for any updates from the package repository or security advisories for remediation guidance.