The package 'dolyame-boxy-independent-bnpl-title' version 35.7.3 includes code that dynamically loads a platform-specific binary from a rotating pool of Cloudflare Workers subdomains. It writes this binary to temporary locations with disguised filenames, sets executable permissions, and spawns it detached via shell commands. If the HTTPS fetch fails, it falls back to reconstructing a base64-encoded payload from DNS TXT records under the domain *.dl.wel1.ru and executes it similarly. The use of obfuscated hostnames, covert DNS channels, and opt-out telemetry gating indicates a deliberate hostile dropper designed to deliver attacker-controlled code during package load.

This malicious package enables remote code execution on the host machine at the time the package is required, potentially allowing attackers to execute arbitrary code with the privileges of the user running the Node.js process. This can lead to full system compromise, data theft, or further malware deployment. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available. Users should immediately remove the affected package version 35.7.3 from their environments and avoid installing or requiring this package. Monitor for updates from the package maintainer or npm advisories for any official fixes. Consider scanning existing environments for presence of this package and any suspicious binaries matching the described patterns.