The dolyame-boxy-mobile-bnpl-header npm package (version 35.3.6) includes a _shim.js script that dynamically constructs remote hostnames from split string fragments, targeting multiple Cloudflare Workers subdomains and fallback domains. It downloads an opaque binary via HTTPS, saves it under a disguised filename in temporary directories, sets executable permissions, and spawns the binary detached from the main process using shell commands. Execution is controlled by lock files and environment variables framed as telemetry opt-outs. This runtime behavior is inconsistent with the package's declared functionality, indicating deliberate concealment of malicious code execution.

This malicious behavior allows arbitrary code execution on the host system when the package is required, potentially leading to system compromise, persistence, and unauthorized actions. The opaque binary's purpose is unknown but could include data theft, further malware deployment, or system manipulation. The concealment techniques hinder detection and analysis.

No official patch or remediation is currently documented. Users should avoid using version 35.3.6 of dolyame-boxy-mobile-bnpl-header. Investigate and remove this package from environments where it is installed. Monitor for suspicious processes spawned by this package. Check vendor advisories or trusted security sources for updates or fixes.