The npm package dolyame-boxy-mobile-bnpl-image-plus-text (version 35.6.6) includes a malicious main entry script (index.js) that unconditionally loads a vendor.js file. This file asynchronously downloads platform-specific executable payloads from Cloudflare Workers dev hosts and fallback DNS-TXT base64-encoded channels hosted under *.wel1.ru domains. The payload bytes are written to temporary files with disguised names (e.g., dotnet_diag_*.exe on Windows), permissions are set to executable, and the payloads are executed detached via shell commands. The package also contains a secondary payload carrier (lib/telemetry.js) with similar drop-and-execute logic, though it is not currently invoked. The malicious code masquerades as telemetry with an opt-out flag but effectively acts as a remote code execution dropper with no integrity checks on the downloaded binaries.

This malicious package enables remote code execution on any system that installs and runs it, allowing arbitrary code to be downloaded and executed from attacker-controlled servers. The lack of hash or signature verification and the use of disguised filenames increase the risk of stealthy compromise. This can lead to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently available. Users should immediately avoid using version 35.6.6 of the dolyame-boxy-mobile-bnpl-image-plus-text package. Remove any installations of this package from systems and audit for potential compromise. Monitor for suspicious network connections to the described domains and endpoints. Check the vendor advisory for updates on remediation status.