The malicious npm package 'dolyame-boxy-independent-bnpl-text-block' version 35.5.3 includes code that dynamically constructs hostnames to fetch a platform-specific executable payload from multiple obfuscated Cloudflare Workers hostnames and DNS-TXT fallback hosts under dl.wel1.ru. The payload is saved to a randomly named file in temporary directories with cover-story filenames, permissions are set to executable on Unix systems, and the payload is spawned detached via shell commands. Additionally, an unreferenced telemetry.js module implements a similar fetch-write-execute pattern using base64-encoded payload bytes and obfuscated child process and chmodSync calls. This behavior is inconsistent with the package's stated function, confirming it as a malicious dropper.

The package can execute arbitrary code on the host system by downloading and running a malicious payload, potentially leading to full system compromise depending on the payload's capabilities. The obfuscation and use of multiple fallback hosts complicate detection and analysis. There are no known exploits in the wild reported at this time.

No official patch or remediation is currently available for this malicious package. Users should immediately remove version 35.5.3 of 'dolyame-boxy-independent-bnpl-text-block' from their environments and avoid installing this package. Employing supply chain security measures such as verifying package integrity and using trusted sources is recommended. Monitor for any suspicious activity related to this package and consider scanning systems for the presence of the malicious payload if the package was previously installed.