The npm package dolyame-boxy-independent-bnpl-swagger (version =35.6.8) includes a malicious setup.js script that reconstructs obfuscated remote hostnames to download platform-specific binary payloads. These payloads are saved as hidden files in temporary directories with executable permissions and launched detached via shell commands. If HTTPS download fails, the payload is retrieved via a covert DNS TXT record channel from specified domains. The downloaded code is unsigned, unpinned, and unrelated to the package's intended BNPL swagger functionality. Additionally, a separate telemetry.js module contains similar drop-and-execute code but is not currently invoked from the main entry point. This behavior constitutes a malicious package rather than a traditional vulnerability.

The malicious code enables remote code execution on the host system by downloading and executing arbitrary binaries without user consent. This can lead to full system compromise, data theft, or further malware deployment. The use of obfuscated hostnames and fallback covert DNS channels complicates detection and blocking. The unsigned and unpinned nature of the payload increases the risk of supply chain compromise for users of this package.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove and avoid using dolyame-boxy-independent-bnpl-swagger version 35.6.8. Employ supply chain security best practices such as verifying package provenance, using trusted package sources, and scanning dependencies for malicious content. Monitor for updates from the package maintainer or npm advisories for any remediation or removal notices.