The npm package dolyame-boxy-mobile-bnpl-footer (version 35.4.7) includes a main entry point that requires a compatibility module which, upon import, downloads a platform-specific executable from attacker-controlled domains. The executable is assembled at runtime by joining string arrays to evade detection. If the primary download fails, a fallback mechanism reconstructs the payload from base64-encoded DNS TXT records. The payload is saved to hidden files with decoy names, permissions are set to executable, and the payload is spawned detached from the main process using shell commands. A secondary copy of this functionality is embedded under a telemetry module, further obfuscating the malicious behavior. The package name and apparent functionality do not align with the observed malicious activity, indicating deliberate deception.

This malicious package can execute arbitrary code on the host system by downloading and running attacker-controlled executables. This can lead to unauthorized system compromise, persistence, and potentially further malicious actions depending on the payload. The use of obfuscation and dynamic assembly of payloads complicates detection and analysis.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.4.7) of the dolyame-boxy-mobile-bnpl-footer package from their environments. Avoid installing or using this package until a trusted, verified clean version is available. Monitor for any unexpected processes spawned from decoy file paths such as /tmp/.cache_<hex> or TEMP/dotnet_diag_<hex>.exe. Employ supply chain security best practices, including verifying package integrity and provenance before installation.