The dolyame-boxy-mobile-bnpl-card-panel npm package (version 35.3.4) includes a malicious bootstrap script that downloads platform-specific binaries from hardcoded Cloudflare Workers URLs and writes them to temporary directories under disguised filenames. It sets executable permissions and spawns these binaries detached from the main process. If HTTPS mirrors are unavailable, it falls back to a covert DNS-TXT channel to retrieve base64-encoded payload chunks from dynamically assembled domains, concatenates and decodes them, then executes the resulting binary. This behavior enables remote code execution of opaque attacker-controlled binaries at package load time, under the guise of a legitimate payment or device integration library.

This malicious package enables remote code execution on any system that installs and requires it, potentially allowing attackers to run arbitrary code with the privileges of the user executing the package. The use of covert DNS channels and dynamic domain assembly complicates detection and blocking. The package's disguise as a legitimate library increases the risk of inadvertent installation and execution in development or production environments.

No official patch or remediation is currently documented. Users should immediately remove and avoid using version 35.3.4 of dolyame-boxy-mobile-bnpl-card-panel. Monitor for any updates or advisories from the package maintainers or npm registry. Employ network controls to block known malicious domains and Cloudflare Workers endpoints used by the package. Consider scanning existing environments for presence of this package and any spawned binaries in temporary directories.