The npm package dolyame-boxy-mobile-bnpl-popup version 35.1.9 includes malicious functionality triggered on require(). It loads _loader.js, which determines a platform-specific payload path and fetches a binary payload from obfuscated hosts assembled via string-split concatenation, including domains such as oob-worker.cf1-02-baf.workers.dev and sdk.dl.wel1.ru. The payload can also be reconstructed from DNS TXT records. The binary is written to temporary directories (/tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe), permissions are set to executable (chmod 0755), and it is executed detached via shell or cmd spawn calls. No integrity checks are performed on the payload. The obfuscation and naming mimic telemetry or diagnostic tools to evade detection. The package misuses a buy-now-pay-later brand name to disguise its malicious intent.

This malicious package can execute arbitrary code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence of malware. The lack of signature verification and use of obfuscated hosts increases the difficulty of detection and mitigation. Since the payload is fetched and executed dynamically, it can be updated or changed by the attacker after installation.

No official patch or remediation is currently documented for this package version. Users should immediately remove the affected version (=35.1.9) of dolyame-boxy-mobile-bnpl-popup from their environments. Avoid installing or using this package. Employ supply chain security measures such as verifying package provenance and using trusted sources. Monitor for any unexpected execution of binaries from temporary directories. Patch status is not yet confirmed — check vendor or repository advisories for updates.