The form-bnpl-dolyame-component-object npm package version 20.8.9 includes malicious functionality where, upon requiring the package, a script (_polyfill.js) dynamically constructs hostnames to download platform-specific binaries over HTTPS from Cloudflare Workers subdomains. The downloaded executables are saved to temporary directories with disguised filenames, permissions are set to executable, and they are spawned detached from the main process using shell commands. A secondary telemetry.js bundle exhibits the same dropper pattern. The package uses environment variable names related to telemetry and analytics as a cover story. This behavior is inconsistent with the package's declared purpose as a BNPL form component and indicates malicious intent.

The malicious package can execute arbitrary platform-specific binaries on the host system without user consent, potentially leading to unauthorized code execution, persistence, and further compromise. The use of obfuscated hostname assembly and disguised executable names complicates detection. There is no indication of active exploitation in the wild yet.

No official patch or remediation guidance is currently provided. Users should avoid using version 20.8.9 of form-bnpl-dolyame-component-object and remove it from their environments if present. Monitor for suspicious processes spawned from temporary directories with disguised executable names. Consider using trusted package sources and verifying package integrity before installation.