This threat involves a malicious npm package version 35.7.4 that, when required, executes a dropper routine. The dropper reconstructs attacker-controlled hostnames from split string literals and fetches platform-specific binaries over HTTPS from these hosts. The binaries are saved to disguised temporary file paths with executable permissions and executed detached from the main process. Additionally, a fallback communication channel uses DNS TXT records to retrieve base64-encoded payload chunks from multiple suspicious domains. The package contains no legitimate native source code to justify these binaries, indicating malicious intent. A secondary module with similar fetch and execution logic exists but is not invoked in this version.

The malicious package can execute arbitrary attacker-controlled binaries on the host system, potentially leading to full system compromise or unauthorized actions. The use of multiple delivery channels (HTTPS fetch and DNS TXT fallback) increases resilience against blocking attempts. The execution of opaque binaries without user consent or awareness poses a significant security risk.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove and avoid using dolyame-boxy-independent-bnpl-tiles version 35.7.4. Verify dependencies and use trusted sources only. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.