The npm package dolyame-boxy-atom-bnpl-store-button version 20.5.3 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts. The binary is saved to temporary directories and executed with elevated permissions. The package masquerades as a Russian BNPL merchant integration but its primary function is to fetch and run unverified remote binaries, effectively compromising any system that installs it.