The npm package dolyame-boxy-stories version 35.9.7 includes a malicious payload in its index.js, which loads _bridge.js. This script dynamically reconstructs domain names to evade static detection and downloads a binary from three attacker-controlled endpoints or a DNS TXT-record fallback. The binary is saved to /var/tmp or %TEMP% with disguised filenames, permissions are set to executable (chmod 0755), and it is launched detached via shell commands (/bin/sh -c or cmd /c start). The package uses marker files and environment variables named to suggest telemetry opt-out, but the declared purpose is unrelated to telemetry, indicating deception. The default code path executes the remote binary immediately, resulting in a load-time full-host remote code execution dropper.

Successful use of this package results in arbitrary code execution on the host system at load time, allowing attackers to run any code with the privileges of the process loading the package. This can lead to full system compromise, data theft, or further malware deployment. The malicious binary is fetched from attacker-controlled infrastructure, enabling dynamic payload delivery and evasion of static detection.

No official patch or remediation is currently documented for this malicious package version. Users should avoid using dolyame-boxy-stories version 35.9.7 entirely. Remove any installations of this package and replace it with trusted alternatives. Monitor for and block network connections to the identified attacker-controlled domains. Employ supply chain security measures such as verifying package integrity and provenance before installation.