The npm package dolyame-boxy-mobile-bnpl-picture-gallery version 35.2.9 contains malicious code that downloads and executes a native binary from attacker-controlled servers. The package masquerades as a payments or BNPL gallery SDK but unconditionally loads a script that reconstructs command-and-control hostnames, downloads an opaque native payload, writes it to a hidden file, sets executable permissions, and executes it detached from the main process. This behavior results in arbitrary code execution on any host that installs or imports this package version.