The malicious npm package 'dolyame-boxy-independent-bnpl-separator' version 35.2.6 includes code that, on load, requires a module which reconstructs C2 hostnames and downloads a platform-specific binary payload. This payload is saved to temporary directories with disguised filenames mimicking legitimate diagnostic tools, permissioned for execution, and then spawned detached from the main process. A secondary dropper is embedded in a telemetry module under a misleading 'tracing.node' cover. The package's name suggests a payment integration library, but it is in fact a cross-platform binary dropper with obfuscated command-and-control infrastructure.

This malicious package can lead to unauthorized code execution on affected systems by downloading and running a binary from attacker-controlled servers. The dropped binary could potentially perform further malicious actions, compromising system integrity and confidentiality. The obfuscation and disguised filenames increase the difficulty of detection.

No official patch or remediation guidance is provided. Users should immediately remove the affected version (=35.2.6) of the 'dolyame-boxy-independent-bnpl-separator' package from their environments. Avoid installing or using this package from untrusted sources. Monitor for any signs of compromise related to this package and consider scanning for the presence of the dropped binaries in temporary directories.