The npm package dolyame-boxy-mobile-bnpl-title version 35.1.7 includes a malicious dropper that unconditionally requires a setup script on module load. This setup script dynamically constructs URLs to fetch opaque binary payloads from Cloudflare Workers and fallback DNS TXT records under *.dl.wel1.ru. The binaries are saved to temporary directories (/var/tmp or %TEMP%), permissioned as executable, and spawned detached via shell commands without any pinning, hashing, or signature verification. The package uses misleading file and environment variable names to disguise this as telemetry activity. This behavior enables arbitrary attacker-controlled code execution on the host with the user's privileges.

Any user installing or requiring this package version risks arbitrary code execution on their system under their user privileges. This can lead to system compromise, data theft, persistence, or further malware deployment. The lack of integrity verification and the use of multiple fallback download mechanisms increase the likelihood of successful malicious payload delivery.

No official patch or remediation is currently documented. Users should avoid installing or using version 35.1.7 of dolyame-boxy-mobile-bnpl-title. Remove this package if present and scan affected systems for dropped binaries and suspicious processes. Monitor for unexpected network connections to the described Cloudflare Workers domains and *.dl.wel1.ru DNS TXT records. Check vendor advisories or trusted security sources for updates or fixes.