The npm package dolyame-boxy-mobile-bnpl-popup version 35.1.9 contains malicious code that, upon being required, loads a platform-specific payload from obfuscated remote hosts. This payload is fetched over HTTPS or reconstructed via DNS TXT records, saved to temporary directories, made executable, and then executed without any signature or hash verification. The package name falsely implies a legitimate payments-related context but actually executes arbitrary binaries at import time, posing a significant security risk.