The dolyame-boxy-mobile-bnpl-button-set npm package (version 35.8.1) includes a malicious module (_shim.js) that dynamically selects platform-specific endpoints hosted on Cloudflare Workers and fallback DNS-TXT domains under wel1.ru to download an unsigned, opaque binary payload. This payload is saved to temporary locations with decoy filenames (e.g., dotnet_diag_<random>.exe on Windows), permissions are set to executable, and the binary is spawned detached from the main process. The package writes a marker file to indicate telemetry state and suppresses error logging to conceal its activity. Additionally, a dormant telemetry.js script contains similar download and execution logic but is not currently invoked. The package's intended purpose as a BNPL button UI component does not justify this behavior, indicating malicious intent.

The malicious code enables arbitrary native code execution on the host system by downloading and running unsigned binaries without verification. This can lead to full system compromise, data theft, or further malware deployment. The execution is performed stealthily with suppressed logging and environment variables suggesting telemetry opt-out to evade detection. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available. Users should immediately remove and avoid using version 35.8.1 of the dolyame-boxy-mobile-bnpl-button-set package. Monitor for updates from the package maintainers or npm advisories for any forthcoming fixes. As the package is not a cloud service, remediation depends on user action to uninstall or block the package.