The npm package dolyame-boxy-mobile-bnpl-image-plus-text version 35.6.6 contains malicious code that downloads and executes platform-specific payloads from attacker-controlled endpoints. The package's main script fetches binary payloads from Cloudflare Workers and fallback DNS-TXT records, writes them to disguised temporary files, sets executable permissions, and runs them detached on the host system. This behavior is disguised as telemetry or analytics functionality but actually enables remote code execution without verification of the downloaded binaries.