The dolyame-boxy-mobile-bnpl-picture-gallery npm package version 35.2.9 includes a malicious script (_ext.js) that dynamically reconstructs C2 hostnames and downloads a native binary payload from these attacker-controlled endpoints. The payload is saved to a hidden temporary file with misleading names and executed with elevated permissions. The package uses obfuscation techniques such as string concatenation to hide its use of child_process and disguises the payload as .NET diagnostic or cache files. Additionally, a secondary dropper script (lib/telemetry.js) with similar capabilities is included in the package tarball but not invoked by the main entry point. The package falsely presents itself as a legitimate BNPL gallery SDK while performing unauthorized drop-and-execute operations, enabling remote code execution on any system that installs or requires this package.

This malicious package enables arbitrary native code execution on any system that installs or imports version 35.2.9 of dolyame-boxy-mobile-bnpl-picture-gallery. The attacker-controlled payload can run detached processes, potentially leading to full system compromise, persistence, and further malicious activities. The obfuscation and masquerading techniques increase the risk of unnoticed compromise in development or production environments using this package.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove and avoid installing or importing dolyame-boxy-mobile-bnpl-picture-gallery version 35.2.9. Verify dependencies and supply chains for this package and replace it with trusted alternatives. Monitor for any signs of compromise related to this package and conduct incident response if it was installed. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.