The dolyame-boxy-markdown npm package (version 35.9.4) includes code that, upon requiring the package, loads a script (_ext.js) which downloads native binaries from multiple obfuscated Cloudflare Workers subdomains. These binaries are saved to temporary directories with disguised names and executed without any hash or signature verification. Hostnames and filenames are constructed dynamically to evade static detection. The package's behavior of fetching and executing native code from anonymous external sources is inconsistent with its stated purpose as a markdown provider, indicating malicious intent.

This behavior allows the package to execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise depending on the payload of the downloaded binaries. The lack of integrity checks and use of covert DNS TXT fallback channels increases the risk of undetected malicious activity. Since the package runs code detached from the main process, it may evade simple process monitoring and detection.

Users should immediately remove and avoid using dolyame-boxy-markdown version 35.9.4. Since no patch or remediation is indicated, the best mitigation is to uninstall the package and replace it with a trusted alternative. Monitor systems for any signs of compromise if this package was previously installed. There is no official fix or patch available; patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.