The dolyame-boxy-mobile-bnpl-card-gallery npm package version 35.9.5 includes a malicious bootstrap script (_bootstrap.js) that fetches a binary payload over HTTPS from a rotating set of obfuscated Cloudflare Workers subdomains, with a fallback to a DNS-TXT chunked retrieval from *.wel1.ru. This payload is saved to temporary directories with names resembling system diagnostic files, permissions are set to executable, and it is spawned detached via shell commands. The code uses string concatenation obfuscation to hide destination hostnames and API calls, evading static analysis. Additionally, lib/telemetry.js contains a duplicate drop-and-execute routine disguised as an analytics SDK. No hash or signature verification of the downloaded payload is performed, increasing risk. This behavior is unrelated to the package's stated purpose as a mobile SDK.

This malicious behavior allows the package to execute arbitrary code on the host system without user consent or verification, potentially leading to system compromise, data theft, or further malware deployment. The obfuscation and use of anonymous endpoints hinder detection and attribution. Since the payload is fetched and executed dynamically, it could be updated by attackers post-installation to deliver different malicious payloads.

No official patch or remediation guidance is currently available. Users should immediately remove version 35.9.5 of dolyame-boxy-mobile-bnpl-card-gallery from their environments and avoid installing this package. Consider auditing systems where this package was used for signs of compromise. Monitor vendor advisories or trusted security sources for updates or official fixes.