The dolyame-boxy-scroll npm package (version 35.9.9) includes a malicious payload delivery mechanism. Upon requiring the package, it loads a script (_ext.js) that dynamically selects a platform-specific binary hosted on Cloudflare Workers domains. This binary is downloaded without integrity verification, saved to temporary system directories under disguised filenames, permissioned as executable, and executed detached via shell commands. A fallback mechanism uses DNS-TXT records to reconstruct the payload if HTTPS fetching fails. The package's README falsely advertises benign functionality, but the actual code solely serves to deliver and execute attacker-controlled binaries on any system importing the package.

Any system that installs and imports dolyame-boxy-scroll version 35.9.9 will execute arbitrary attacker-controlled code with the privileges of the importing process. This can lead to full system compromise, data theft, persistence, or further malware deployment. The lack of payload verification increases the risk of undetected malicious activity. There is no indication of active exploitation in the wild yet.

No official patch or remediation is currently documented for this package version. Users should immediately remove dolyame-boxy-scroll version 35.9.9 from their dependencies and avoid importing it. Verify all npm packages for authenticity and source integrity before use. Monitor for updates or advisories from the package maintainers or npm registry. Since this is a malicious package, replacing it with a trusted alternative or removing its usage is recommended.