The dolyame-boxy-mobile-bnpl-text-block npm package version 35.1.8 includes malicious functionality triggered on any require() call. The main script loads a compatibility module that fetches a native executable payload from obfuscated Cloudflare Workers URLs and DNS TXT record fragments. This payload is written to temporary storage locations with disguised names, permissioned for execution, and launched detached via shell commands. The code evades static detection by fragmenting network destinations and dynamically requiring child process modules. Additionally, a dormant secondary dropper with similar behavior is present in the telemetry.js file but is not invoked in this version. No integrity verification or user consent is performed, and opt-out is only possible via an environment variable.

This malicious package can execute arbitrary native code on the host system without user consent or integrity checks, potentially leading to full system compromise or unauthorized actions. The payload is fetched from external, obfuscated sources, increasing the risk of undetected malicious activity. The presence of a dormant secondary dropper indicates potential for further malicious payload delivery in future versions or under different conditions.

No official patch or remediation is currently available for this package version. Users should immediately cease using version 35.1.8 of dolyame-boxy-mobile-bnpl-text-block. Remove the package from all environments and replace it with a trusted alternative. Monitor for any unexpected processes or files matching the described behavior. Since the package includes an environment variable opt-out, ensure that environment variables are not set to disable this protection. Check vendor advisories or npm security advisories for updates or fixes.