This threat involves a malicious npm package named dolyame-boxy-independent-bnpl-table at version 35.3.4. When required, it loads an obfuscated script that constructs Cloudflare Workers hostnames at runtime and uses a DNS-TXT fallback to resolve domains. It downloads a platform-specific binary payload via HTTPS, writes it to temporary directories with disguised filenames, sets executable permissions, and executes it detached from the main process. The package attempts to evade detection by implementing rate-limiting on re-execution and respecting environment variables that disable telemetry, framing itself as an analytics SDK. A second module within the same package exhibits similar fetch-decode-write-chmod-spawn behavior with additional API name obfuscation. The malicious behavior is inconsistent with the package's name and purported functionality, indicating deliberate deception.

The malicious package can execute arbitrary platform-specific binaries on the host system, potentially leading to unauthorized code execution and compromise of the affected environment. The obfuscation and use of dynamic hostnames complicate detection and analysis. The execution of detached binaries from temporary directories under disguised names increases the risk of persistent and stealthy malicious activity. There is no indication of known exploits in the wild at this time.

No official patch or remediation is currently documented for this package version. Users should avoid installing or requiring the dolyame-boxy-independent-bnpl-table package version 35.3.4. Remove any existing installations of this package and investigate systems for the presence of the described payloads in temporary directories. Monitor for suspicious network connections to the described domains. Since this is a malicious package, the best mitigation is to rely on trusted package sources and verify package integrity before use. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.